English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Applications running in Trusted Execution Environments (TEEs) commonly useuntrusted external services such as host File System. Adversaries maymaliciously alter the normal service behavior to trigger subtle applicationbugs that would have never occurred under correct service operation, causingdata leaks and integrity violations. Unfortunately, existing manual protectionsare incomplete and ad-hoc, whereas formally-verified ones require specialexpertise.  We introduce GateKeeper, a framework to develop mitigations and vulnerabilitycheckers for such attacks by leveraging lightweight formal models of untrustedservices. With the attack seen as a violation of a services' functionalcorrectness, GateKeeper takes a novel approach to develop a comprehensive modelof a service without requiring formal methods expertise. We harness availabletesting suites routinely used in service development to tighten the model toknown correct service implementation. GateKeeper uses the resulting model toautomatically generate (1) a correct-by-construction runtime service validatorin C that is linked with a trusted application and guards each serviceinvocation to conform to the model; and (2) a targeted model-drivenvulnerability checker for analyzing black-box applications.  We evaluate GateKeeper on Intel SGX enclaves. We develop comprehensive modelsof a POSIX file system and OS synchronization primitives while using thousandsof existing test suites to tighten their models to the actual Linuximplementations. We generate the validator and integrate it with Graphene-SGX,and successfully protect unmodified Memcached and SQLite with negligibleoverheads. The generated vulnerability checker detects novel vulnerabilities inthe Graphene-SGX protection layer and production applications.

Securing Access to Untrusted Services From TEEs with GateKeeper