Search

Secure containers implemented in both software and hardware are being used to isolate and reduce attack vectors on executing software. The isolation of software partitions protects the data and the execution from external software (e.g. the OS, other applications, other software partitions within the same application). Despite the existence of many hardware isolation technologies such as ARM TrustZone, Intel Software Guard Extension (SGX), and others, it is still not clear how to efficiently use isolation to secure applications data. This is particularly the case when considering vulnerabilities within the application, strong adversaries who have control over the OS, and performance requirements of the application. Previous work demonstrated the efficiency of SGX in protecting against memory leakage vulnerabilities. However, since SGX allows separation of privileges through partitioning monolithic applications into compartments, using it in mitigating faulty API vulnerabilities or Buffer over-writes is far from being straightforward. To illustrate, we found that many systems with ”secure containers” capabilities do not deliver the security expected from containers, which indicates an absence of a methodology for using Trusted Execution Environment (TEE) systems. For example, our analysis of Samsung KNOX architecture revealed that such systems cannot protect against memory leakage, buffer over-reads, buffer over-writes, and others. In this thesis two research hypotheses are investigated. First, privilege separation through application partitioning enhanced TEE can be used to mitigate software vulnerabilities, protect containers from privileged kernel, while maintaining the reasonable performance of an application . Second, partitioning patterns can be used to mitigate different threats. We demonstrate how vulnerabilities can be mitigated with secure containers and how the specific design of the secure containers determines the success of the desired protection from such a paradigm. This research uncovers the potential of TEE in separating privileges in applications using hardware based technologies instead of access control enforced in several layers by software. The realisation of the potential of secure containers will help corporations and enterprises design better secure systems and devices that protect end-users data from application and system vulnerabilities and attacks performed by software.

In practicable multi-level secure systems it is necessary occasionally to transfer information in violation of security policy. Machines for doing this reliably and securely are called cross domain solutions; systems incorporating them are cross domain systems. Data owners, especially in classified environments, tend to distrust other data owners, other systems and networks, their own users, and developers of cross domain solutions. Hence, data owners demand rigorous testing before they will allow their information into a cross domain system. The interests of data owners are represented by certifiers and accreditors, who test newly developed cross domain solutions and newly installed cross domain systems, respectively. Accreditors have the authority to grant approval to operate and the responsibility for accepting residual risk. Certification and accreditation have always been expensive and time consuming, but there are hidden inefficiencies and unexploited opportunities to predict the actions of accreditors and to control the cost of certification. Some case studies of successful and unsuccessful security certifications and accreditations were analysed using grounded theory methodology. It was discovered that inefficiency arises from conflation of the principle of defence in depth with the practice of independent verification and validation, resulting in an irresistible appearance of cost savings to managers with a possible explanation in the relative maturity of different levels of software engineering organisations with respect to policy, process, and procedures. It was discovered that there is a simple rule relating certifier findings to developer responses that predicts the duration of penetration testing and can be used to bound the schedule. An abstract model of cross domain system accreditation was developed that is sufficiently powerful to reason about collateral, compartmented, and international installations. It was discovered that the behaviour of accreditors satisfies the criteria for reliable signalling in the presence of asymmetric information due to Akerlof, Spence, and Stiglitz.