Packet encapsulation is a general network technique that provides an essential building block for constructing secure networks. While extensively used in IP networks over the last few decades, secure packet encapsulation remains largely unexplored in the context of Named Data Networking (NDN) networks. NDN represents a radical departure from traditional endpoint-oriented networking by making secured data the centerpiece of communication. This new data-centric design brings both advantages and new challenges for the development of secure packet encapsulation that can preserve essential properties of an NDN network, including in-network data caching and builtin multicast data delivery. In this paper, we first identify the major differences between encapsulation solution designs in IP and NDN, highlighting the ensuing challenges, both inherent and practical. We then present a novel design to achieve secure NDN data packet encapsulation, and showcase an implementation suite that enables efficient fetching of securely encapsulated data.11The views, opinions and/or findings expressed are those of the authors and should not be interpreted as representing the official views or policies of the Department of Defense or the U.S. Government. Distribution Statement “A” (Approved for Public Release, Distribution Unlimited)

Recent advances in side-channel attacks put intoquestion the viability of Simultaneous Multithreading (SMT) architectures from the security standpoint. To address this problem, we propose SMT-COP-a system that eliminates all known side-channels through shared execution logic, including ports and functional units, on SMT processors. At the core of SMT-COP is a small modification to the instruction scheduling logic that allows support for both spatial and temporal partitioning of the execution units to prevent controllable contention for these resources that causes side-channel attacks. We demonstrate thatthe security benefits of SMT-COP are achieved with modest performance overhead and hardware complexity, and without relying on software support. Further performance improvements can be achieved when SMT-COP is applied selectively, and we consider three forms of such selective application: a) in response to detecting resource contention; b) in response to detecting manipulations with time measurement infrastructure; and c) in response to explicit requests by applications. This study represents a step towards making SMT processors more secure.

We present LATCH (short for Locality-Aware Taint CHecker), a generalizable architecture for optimizing dynamic information flow tracking (DIFT). LATCH exploits the observation that information flows under DIFT exhibit strong temporal locality, with typical applications manipulating sensitive data during limited phases of computation. This property allows LATCH to monitor significant spans of execution using lightweight, coarse-grained checks, invoking precise, computationally intensive tracking logic only during periods of execution that involve sensitive data. LATCH implements this policy without sacrificing the accuracy of DIFT.