CoPrIME: Complete Process Isolation Using Memory Encryption
摘要
As operating systems grow in functionality, their code bases become larger and it becomes difficult to formally verify them. As a result, a lot of bugs and vulnerabilities in operating systems remain unnoticed. These bugs can be exploited by attackers to compromise the operating system. Since the operating system runs at a higher privilege and has unrestricted access to the address space of all processes running in the system, a bug in the OS can lead to all applications in the system getting compromised. Thus, there is a need to protect the applications against these untrusted operating systems. The traditional approach to protect the security-sensitive modules of an application against an untrusted OS is the execution of these modules in Trusted Execution Environments (TEEs) but these TEEs come with certain limitations. A major drawback is the need to modify the application for it to work in a TEE which makes the concept of TEEs inapplicable to legacy applications. We propose an orthogonal approach to protect the entire application using cryptographic techniques which is compatible with legacy applications with no need to modify the source code.