Abstract
Are you sure the last Virtual Machine bought from your Cloud Provider is working prop erly? The growing popularity of cloud infrastructures allowed online businesses to ben efit from larger market segments, parallelly, armies of adversaries enjoyed a vaster set of possible victims. Additionally, leaving part of the infrastructure on cloud providers de facto reduced the companies control over their products, eventually increasing the attack surface to either insider or external threats. This urges companies to adopt ad vanced protections for their products and data. In this zero-trust scenario, a common countermeasure is represented by Trusted Ex ecution Environments (TEE). These technologies use hardware mechanisms to create trusted regions shielded against fully compromised systems, thus allowing the compa nies to protect their assets even if the whole data center is compromised. Specifically, trusted regions achieve this goal through two properties: memory isolation and remote at testation. The former ensures physical isolation of trusted regions, thus avoiding direct writing to, and reading from, the protected memory pages. The latter, instead, enables a remote entity to verify the software loaded into a trusted region. The combination of memory isolation and remote attestation is a solid base for build ing more secure applications over the Internet. TEEs, however, are far from being the final weapons in the security war since they suffer from critical limitations: the trusted regions’ size is capped at few megabytes, thus having scalability issues; a trusted re gion may be misused to hide malware, thus leading to new security threats; or else, an adversary may exploit memory corruption errors to hijack a trusted region execution (without altering its code), thus evading either memory isolation and remote attestation. The goal of this thesis is to investigate these limitations, explore new threats, and fi nally, propose suitable mitigation. In particular, we discuss five contributions: three regarding memory isolation, and two about remote attestation. The first part of the thesis revolves around memory isolation. We address scalabil ity limitations affecting TEEs and propose more flexible designs that combine anti tampering techniques and fit the current market products (Chapter 3). Then, we in vestigate new threats that exploit the memory isolation and implant malicious software in a trusted region by using advanced runtime techniques (Chapter 4). Finally, we study the implication of (compromised) trusted regions when performing incident response, and propose new techniques to fill the current gaps (Chapter 5). In the second part, we extend the remote attestation schemes to identify the runtime attacks described in Chapter 4. First, we propose a novel model suitable for software of any complexity, thus overcoming the scalability issues of current approaches (Chap ter 6). Then, we propose an additional model that fits trusted regions’ specifications, thus stretching the runtime protection over memory isolated objects (Chapter 7). In conclusion, we summarize the results achieved and draw directions for future researches regarding TEE in cloud computing.