Secure and Efficient Multi-Variant Execution in Distributed Settings

This paper discusses dMVX, a system for secure multi-variant execution in distributed settings to mitigate memory errors and protect against attacks. Using leader and follower variants, diversified program variants run in lockstep to ensure security. The system monitors and replicates I/O results, enhancing protection against attacks exploiting absolute addresses or memory locations. However, challenges such as limited diversity within a single platform are noted, and Distributed Heterogeneous N-Variant Execution is proposed as a solution.

• Security
• Multi-Variant Execution
• Distributed Systems
• Memory Safety
• Program Diversification

tyro_79 Follow

Uploaded on Sep 18, 2024 | 0 Views

Download Presentation

Please find below an Image/Link to download the presentation.

The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.

Presentation Transcript

1. dMVX: Secure and Efficient Multi-Variant Execution in a Distributed Setting Alexios Voulimeneas, Dokyung Song, Per Larsen, Michael Franz, Stijn Volckaert 1

2. 2

3. 3

4. Solutions Memory-Safe Programming Languages (e.g. Rust) Mitigations: Integrity Enforcement (e.g. CFI) Software Diversity (e.g. ASLR) Multi-Variant eXecution (MVX) 4

5. Multi-Variant eXecution (MVX) In a nutshell: Leader Variant Follower Variant Run multiple diversified program variants in lockstep on identical inputs t t Suspend them at every system call write brk brk write Compare system call numbers/arguments Monitor Replicate I/O results Kernel 5

6. MVX Systems Security (1) Protection against attacks that rely on knowledge of absolute addresses Protection against attacks that attempt to acquire knowledge through information leakage Bruschi et al. Diversified process replicae for defeating memory error exploits. In IPCCC, 2007. Volckaert et al. Cloning your gadgets: Complete ROP attack immunity with multi-variant execution. In TDSC, 2012. Lu et al. Stopping memory disclosures via diversification and replicated execution. In TDSC, 2018. 6

7. MVX Systems Security (2) Vulnerable to attacks that use relative memory locations Data-only attacks are still possible Hu et al. Data-oriented programming: On the expressiveness of non-control data attacks. In S&P, 2016. G ktas et al. Position-independent code reuse: On the eectiveness of ASLR in the absence of information disclosure. In EuroS&P, 2018. 7

8. Observation: Diversity is limited to what a single platform can offer. 8

9. DMON (DIMVA 2020) Leader Variant Follower Variant syscall (...) syscall (...) Inter-Monitor Communication via Network Monitor Monitor Kernel Kernel 9 Physical host 1 Physical host 2

10. Distributed Heterogeneous N-Variant Execution - Variants run on different physical machines - Leverage ISA and ABI heterogeneity to increase diversity 10

11. Additional Diversity ISA ISA- -Heterogeneity Heterogeneity ABI ABI- -Heterogeneity Heterogeneity Size of primitive data types Structs layout - Packing - Alignment - Padding Constants - System call numbers - Flags and modes Calling conventions Machine instructions Endianness Register set Pointer width Available system calls 11

12. Performance (?) System Call Interception Monitoring and Replication 12

13. DMON (DIMVA 2020) Leader Variant Follower Variant syscall Monitor Monitor Kernel Kernel 13 Physical host 1 Physical host 2

14. ReMon (ATC 2016) Hybrid MVX design - Cross-process monitor (CP-MON) - In-process monitor (IP-MON) Classification of system calls CP-MON handles security-sensitive system calls (e.g. execve) IP-MON handles non-sensitive system calls (e.g., getpid) 14

15. Distributed Hybrid Design Leader Variant Follower Variant DIP-MON DIP-MON execve getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 15 Physical host 1 Physical host 2

16. Distributed Hybrid Design Leader Variant Follower Variant DIP-MON DIP-MON execve getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 16 Physical host 1 Physical host 2

17. dMVX Design CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid execve DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 17 Physical host 1 Physical host 2

18. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid execve DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 18 Physical host 1 Physical host 2

19. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR execve DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 19 Physical host 1 Physical host 2

20. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 20 Physical host 1 Physical host 2

21. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 21 Physical host 1 Physical host 2

22. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 22 Physical host 1 Physical host 2

23. Core Components CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 23 Physical host 1 Physical host 2

24. Additional Optimizations Replication is still expensive Asynchronous replication Avoid replication when possible 24

25. Replication Follower Variant Leader Variant Expensive replication of results through network DIP-MON DIP-MON syscall DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 25 Physical host 1 Physical host 2

26. Asynchronous Replication CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 26 Physical host 1 Physical host 2

27. Asynchronous Replication CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 27 Physical host 1 Physical host 2

28. Asynchronous Replication CB CB Follower Variant Leader Variant DIP-MON DIP-MON CONNECTOR CONNECTOR getpid DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 28 Physical host 1 Physical host 2

29. Selective Replication (1) Files that are not changed by an external process. Follower Variant Leader Variant DIP-MON DIP-MON Each Variant uses its own copy of the file for I/O operations. read/write read/write DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 29 Physical host 1 Physical host 2

30. Selective Replication (2) System calls with expected results. Follower Variant Leader Variant DIP-MON DIP-MON Use metadata to predict result. syscall syscall DCP-MON DCP-MON Syscall Broker Kernel Syscall Broker Kernel 30 Physical host 1 Physical host 2

31. Security of dMVX Security-sensitive system calls are always monitored CONNECTOR is a separate process Information hiding to protect the in-process monitors and sensitive values 31

32. Case Studies Benchmark DMON dMVX 37.04 6.78 READ 39.39 2.79 GETCWD 37.90 2.87 SCHED_YIELD 5.43 Lighttpd 3.1% 32

33. Case Studies Benchmark DMON dMVX 37.04 6.78 READ 39.39 2.79 GETCWD 37.90 2.87 SCHED_YIELD 5.43 Lighttpd 3.1% 33

34. Conslusion dMVX: new distributed hybrid MVX design - Low system call interception cost - Avoid monitoring and replication when possible - Provide similar security guarantees with other distributed MVX systems Evaluation - Microbenchmarks - Lighttpd 34

35. 35