Ikuya Morikawa

Cozilet: transparent encapsulation to prevent abuse of trusted applets

We have developed a mechanism which prevents abuse of trusted Java applets, such as digitally signed applets. A signed applet is usually permitted by a user to perform certain functions. However, an attacker may improperly recompose the signed applet to include malicious components and harm the user by abusing such functions of a signed applet. In this paper, we call this a malicious recomposition attack and propose an innovative mechanism to solve the problem of such attacks. Before deployment, a target signed applet is encapsulated into a special signed applet, called a cozilet, in an indecomposable format. On its execution, the cozilet isolates the classes and resources of the encapsulated applet by assigning a special class loader unique to the applet. It also enforces applet-document binding so that it is never executed from untrusted HTML documents. The mechanism is easily applicable to target signed applets because it is transparent not only to target applets, but also to current Java VM implementations. Therefore, the mechanism can easily protect both applets developed in the future and the applets currently in use. We have implemented this mechanism for Sun Java VM. In this paper, we describe its basic architecture and implementation details.

A Secure Framework for User-Key Provisioning to SGX Enclaves

Intel Software Guard Extensions (SGX) protects user software from malware by maintaining the confidentiality and integrity of the software executed in secure enclaves on random access memory. However, the confidentiality of its stored executable is not guaranteed. Therefore, secret information, e.g. user keys, should be provided to the enclaves via appropriate secure channels. Although one of the solutions is to use remote attestation function of SGX, there is a potential risk that user keys are exposed to malicious insiders at the service provider of remote attestation. In this paper, we propose a novel and secure framework for user-key provisioning to SGX enclaves. Our framework utilizes sealing function of SGX, and consists of two phases: the provisioning phase and the operation phase. In the provisioning phase, a user key is encrypted by sealing function, and it is stored in storage. Our assumption is that this phase is performed in a secure environment. In the operation phase, the encrypted blob is read from the storage and decrypted. Then, SGX applications can use the user key without exposing it to attackers. We implemented a prototype of our framework using a commercial Intel CPU and evaluated its feasibility.