This NSPW panel discussed how we, as a community, should pursue evidence-based research on designs for commoditizable mass-market secure operating systems. This panel did not discuss what features or architectures should be adopted, but instead focused on how we evaluate competing features and designs. How can, or should, we gather data about the usability and resilience of secure OS designs without requiring massive implementations and deployments?

MinimaLT is a new network protocol that provides ubiquitous encryption for maximal confidentiality, including protecting packet headers. MinimaLT provides server and user authentication, extensive Denial-of-Service protections, privacy-preserving IP mobility, and fast key erasure. We describe the protocol, demonstrate its performance relative to TLS and unencrypted TCP/IP, and analyze its protections, including its resilience against DoS attacks. By exploiting the properties of its cryptographic protections, MinimaLT is able to eliminate three way handshakes and thus create connections faster than unencrypted TCP/IP.

Jails, Sandboxes and other isolation mechanisms limit the damage from untrusted programs by reducing a process's privileges to the minimum. Sandboxing is designed to thwart such threats as (1) a program created by an attacker or (2) an input crafted to exploit a security vulnerability in a program. Examples of the later include input containing interpreted code or machine language to be injected via a buffer overflow. Traditionally, sandboxes are created by an invoking process. This is effective for (1) but only partially so for (2). For example, when a file is downloaded by a browser or processed as a mail attachment, the invoking process can sandbox it. However, sandboxing protections can be circumvented when the file is copied outside the sandbox. The problem is that traditional sandboxes do not provide complete mediation. We introduce dynamic sandboxes, and show how even when data is saved and/or copied, sandboxing protections are not lost. In addition, and in contrast to traditional sandbox implementations, dynamic sandboxes are implemented using general purpose access controls. Not only does this provide a more flexible sandbox mechanism, and enable complete mediation, but these same primitives can be used to build other (non-sandbox) authorization policies.

For over 30 years, system software has been bound by compatibility with legacy applications. The system software base, whether proprietary or open source, is dominated by the programming language C and the POSIX operating system specification. Even when commercial operating systems stray from this model, they don't go very far.

Application security is typically coded in the application. In kernelSec, we are investigating mechanisms to implement application security in an operating system kernel. The mechanisms are oriented towards providing authorization properties, and this goal drives the design of permissions and protection mechanisms.The resulting system is dynamic, allowing the set of permissions for a program to evolve during program execution. This reduces the need for users and applications to be aware of protection mechanism, since the protection mechanism provides the user with more freedom in how they do things. We explore these properties through a number of examples.KernelSec also supports a group (role) mechanism which can define constrained groups enabling groups which only grow, only shrink, are constant, are mutually exclusive with other groups, and which allow inheritance. Moreover groups are used to regulate group membership and allow group administration by non-privileged users.

Consider a set of users who collectively perform a sequence of actions to complete a task. Separation of duty constraints hold when there are restrictions which are intended to require that not all actions are performed by the same user.The approvability graph is introduced to describe the sequences of actions which correspond to one or more tasks. The graph can represent multiple possible outcomes (different completions from the same starting point) as well as allowing for repeated actions. Hence, the graph describes a set of sequences, not necessarily finite, which define when a task is complete.The graph-based mechanism also describes separation of duty constraints between different actions, ensuring that different actions are performed by different users. (It can also require different actions to be performed by the same user.)Algorithms are presented to analyze the number of users needed to ensure that any such sequence can be completed, even in the presence of loops or alternative outcomes. The various properties that arise in approval sequences are then explored to characterize well formed systems and to examine their complexity. In particular, we show how to achieve bounds on the number of users which must be members of each role.Determining the minimum number of users to complete a dynamic separation of duty task is proven to be NP-Complete.

This paper examines some of the criteria for a certificate architecture that supports trusted collaboration. Key to this support are: (1) the separation of statements from the actions they engender and (2) the ability to make arbitrary statements. The separation of statement from action enables organizations to set their own policies and therefore control what is authorized in response to a statement. The open ended nature to allow arbitrary statements to be created enables the signer to fully specify her intentions. It should be possible to make these statements arbitrarily precise, by tying the statements to their (semantic) contexts. Furthermore, we argue that it is important not only to support completely formalizable statements but also informal statements as well. We then describe an architecture we are building which meets the above criteria and give examples of its efficacy

An access control design can be viewed as a three layered entity: the general access control model; the parameterization of the access control model; and the initial users and objects of the system before it goes live. The design of this three-tiered mechanism can be evaluated according to two broad measures, the expressiveness versus the complexity of the system. In particular, the question arises: What security properties can be expressed and verified? We present a general access control model which can be parameterized at the second layer to implement (express) any of the standard Discretionary Access Control (DAC) models. We show that the safety problem is decidable for any access control model implemented using our general access control model. Until now, all general access control models that were known to be sufficiently expressive to implement the full range of DAC models had an undecidable safety problem. Thus, given our model all of the standard DAC models (plus many others) can be implemented in a system in which their safety properties are decidable.

Integrated network barriers (INBs) are network protocols for parallel processors. INBs are both pipelinable and have low latency. In this paper, we show that INBs implement barriers-which ensure that all prebarrier operations of any processor appear to complete before any post-barrier operations-and we show how to construct efficient, deadlock-free barriers for any interconnection network and routing function which has an acyclic queue dependency graph. As a special case, INBs can be implemented for any network and routing function for which there exists an acyclic channel dependency graph.

The primary performance measure of a routing network is the graph of bandwidth achieved for a given latency.At low loads, latency increases with increasing bandwidth utilization.As the load increases, the bandwidth utilization increases until saturation is reached, at which point bandwidth decreases and latency increases.This paper describes a congestion control mechanism that prevents saturation from occurring and also helps with local congestion at the switches.It can be run continuously in the network hardware since it does not increase latency of short-haul messages; it ensures that each processor gets an equal share of network bandwidth; and can be implemented entirely in the network without processor modification.

In bandwidth limited computers, such as meshes and tori, it is important to achieve high bandwidth across the bisection. Traditional techniques achieve bandwidth in the range of 30–70%. We show how to use barriers, in particular Integrated Network Barriers to achieve high bandwidth utilization which is arbitrarily close to 100%. This technique also provides low latency and fairness to processors. Moreover, it works globally and therefore is not dependent on local approximations of network traffic.

Traditional mirrored disk systems provide high reliability by multiplexing disks. Performance is improved with parallel reads and shorter read seeks. However, writes must be performed by both disks, limiting performance.

To date, the implementation of message passing languages has required hte communications variables (sometimes called ports) either to be limited to the number of physical communications registers in the machine or to be mapped to memory. Neither solution is satisfactory. Limiting the number of variables decreases modularity and efficiency of parallel programs. Mapping variables to memory increases the cost of communications and the granularity of parallelism. We present here a new programming language construct called epochs . Epochs are a scoping mechanism within which the programmer can declare communications variables, which are live only during the scope of that epoch. To limit the range of time a register has to be allocated for a communications variable, the compiler ensures that all processors enter an epoch simultaneously. The programming style engendered fits somewhere between the SIMD data parallel and the MIMD process spawning models. We describe an implementation for epochs including an efficient synchronization mechanism, a means of statically binding registers to communications variables, and a method of fusing epochs to reduce synchronization overhead.

With recent declines in the cost of semiconductor memory and the increasing need for high performance I/O disk systems, it makes sense to consider the design of large caches. In this paper, we consider the effect of caching writes. We show that cache sizes in the range of a few percent allow writes to be performed at negligible or no cost and independently of locality considerations.

A data structure derived from corner stitching which allows efficient representation of VLSI layouts is presented. While each entry in the expanded rectangle database is larger than the corresponding corner-stitched entry, generally fewer entries are required to represent the same VLSI layout. The data structure has two important features: first, the VLSI design is represented as a slicing structure in which each slice contains a portion of the solid material; and second, corner stitches are used to provide two-dimensional nearness information. Initial measurements indicate that expanded rectangles is a viable data structure for use in a complete VLSI layout system.>

We describe a support language, GENERIC, for producing high quality, general purpose layout in a silicon compiler. Since layout is the critical bottleneck to producing high-quality integrated circuits in silicon compilers, better methods are needed for this critical task. GENERIC forms a rich semantic base for describing and manipulating layout in a VLSI design system, enabling more complex layout to be generated. No particular design style is imposed by the language; Instead, operators and data structures are provided for efficient and effective manipulation of the layout. The operators form a more abstract basis for implementing layout strategies, and yet are still inherently efficient.