Dynamic Measurement and Protected Execution: Model and Analysis

Abstract

Useful security properties arise from sealing data to specific units of code. Modern processors featuring Intel’s TXT and AMD’s SVM achieve this by a process of measured and protected execution. Only code which has the correct measurement can access the data, and this code runs in an environment protected from observation and interference. We present a modelling language with primitives for protected execution, along with its semantics. We characterise an attacker who has access to all the capabilities of the hardware. In order to achieve automatic analysis of systems using protected execution without attempting to search an infinite state space, we define transformations that reduce the number of times the attacker needs to use protected execution to a pre-determined bound. Given reasonable assumptions we prove the soundness of the transformation: no secrecy attacks are lost by applying it. We then describe using the StatVerif extensions to ProVerif to model the bounded invocations of protected execution. We show the analysis of realistic systems, for which we provide case studies.

Proof of Theorem 1

Suppose $K$ contains $B_1$, $B_2$, ..., $B_n$. Let $m$ be the number of sealed blobs in $\overline{\mathsf{K }}$, as in Definition 1. Let $S$ be a strategy such that . Then:

1 $\exists S'$ such that .

2 $S'$ simulates $S$; that is $\exists q$ such that .

3 $S'$ uses only data present in $S$, i.e. $\text {names}(S') \subseteq \text {names}(S)$.

4 The number of $\mathsf{SKINIT }$s plus the number of $\mathsf{reset }$s in $S'$ is at most $m$.

We first prove a number of lemmas.

Lemma 1

implies .

Proof

We show this by induction on $S$.

Base case $S = \emptyset$. The proof is obvious, setting $p'' = p$.

Inductive case $S = C; S_1$. We have . Take any $p$.

Taking each case of C

$\mathsf{skip }, x := f(), x:=g(), x:=\mathsf{seal }(u, v), \mathsf{check }\; u = v$ We have $p' =\bot$, and . Apply IH with $p$ to obtain $p''$, and we have , i.e. .

$\mathsf{unseal }(v)$ This situation is impossible.

$\mathsf{extend }(v)$We have $p' =\bot$ and . Apply IH with $h(p, v)$ to obtain $p''$, and we then have i.e. .

$\mathsf{reset }, \mathsf{SKINIT } \{ P; \mathsf{rtn }\,u \}$ We have $p'=1$ and , and , i.e. set $p'' = p'''$ and we have .

Lemma 2

implies .

Proof

Consider each case of $C$ in turn.

Lemma 3

implies .

Proof

Consider each case of $C$ in turn. For unseal, we prove the left disjunct. For all other cases, we prove the right disjunct.

Lemma 4

If $p \ne \bot$ then implies .

Proof

Consider each case of $C$ in turn.

Lemma 5

implies or .

Proof

Consider each case of $C$ in turn. For unseal, we prove the left disjunct. For all other cases, we prove the right disjunct.

Part 1 of Theorem 1

implies .

Proof

We prove something more general:

implies .

Base case $S = \emptyset$ is obvious.

Inductive case $S = C; S_1$

Suppose .

Expanding: . By inductive hypothesis, $\exists S_1' .$

• either . From , by Lemma 2, $\exists C'$.. So set $S' = C'; S_1'$. Then .

• or . From , by Lemma 3, either , so , or , so where again, $S' = C'; S_1'$.

Part 2 of Theorem 1

implies .

Proof

We prove something stronger:

implies .

We prove this using induction on $S$.

Base case $S = \emptyset$ is obvious.

Inductive case $S = C; S_1$. Inductive hypothesis: implies .

We want to prove i.e. .

• Either $p' = \bot$

  • either $p = \bot$: , so by Lemma 4 and IH , i.e. .

  • or $p \ne \bot$: . by Lemma 5 and IH $\exists p'' .$

    • either , Then by Lemma 1, , i.e. .

    • or . Then by Lemma 1, , i.e. .

• or $p' \ne \bot$ then by Lemma 4, and so by IH , i.e. .

Part 3 of Theorem 1

$S'$ uses only the data present in $S$ that is, every name in $S'$ is in $S$.

Part 3 of the theorem is readily proved by inspection of the transformation.

Part 4 of Theorem 1

The number of $\mathsf{SKINIT }$s plus the number of $\mathsf{reset }$s in $S'$ is at most $m$.

Part 4 follows from the facts that:

• at most $m$ plaintext-distinct sealed blobs can be produced from the initial data;

• the transformed strategy $S'$ runs at most one SKINIT for each blob sealed to a PCR value rooted in 0 (other invocations are run as SUBRs);

• the transformed strategy $S'$ runs at most one reset for each sealed blob rooted in 1 (other resets are transformed into skips).