The goal of this project was to study the unified abstractions and management of software security at data-center scale.  We prototyped and evaluated S2OS, a security OS for managing software-defined infrastructure. S2OS contributes techniques for virtualizing hardware and software, including components that predate S2OS, such as trusted execution environment (TEE) hardware.  This project demonstrates the potential for leveraging global information, such as using machine learning on network data to identify and defend against malware.  This project has also contributed additional system management and security data, tools, and techniques.

Intellectual Merit: One set of contributions from this project are in the area of techniques to virtualize, or abstract and integrate, hardware and software that is not designed for software-defined security management.  Examples include vSGX, a virtualized environment for running code designed for Intel's SGX on AMD's SEV both are trusted execution environments with different requirements and restrictions, facilitating more flexible code deployments.  Similarly, the project has contributed techniques for refactoring code to deploy in a TEE, and has demonstrated that, unlike CPU hardware, the most efficient layer for virtualizing accelerators, such as GPUs, is at the software API level.

A second set of contributions from the project come from studying how to program management software across these hardware and software resources in a data center.  For instance, the Toccoa sub-project supports programmable network packet analysis at the rate of tens of millions of packets per second, while also scaling out to more nodes linearly.  Similarly, the SysFlow sub-project is a programming framework for modeling and controlling software activities across the entire infrastructure, providing a data-center-scale data plane and control plane separation.

Finally, S2OS contributes novel security defense and mitigation techniques that are only possible with data collected, analyzed, and applied at scale.  For instance, the IMap sub-project shows how to implement network-level defenses that leverage data collected at scale, yet are deployed in individual switches.  The xNIDS sub-project further applies machine learning to characterize network traffic, troubleshoot issues, and automatically generate defenses.  Similarly, our study of ransomware defense shows that network-level monitoring for a command-and-control channel can be more effective than tracking file access behavior on a single system.  Other examples of novel security management applications enabled by S2OS include 1) risk-aware micro-segmentation for micro-services, which confines file accesses within a container's scope and isolates potentially compromised containers from one another; 2) Fine-grained and Context-aware Access Control (FCAC) in Web Applications, which offers context-aware, fine-grained access control within web servers, and 3) Virtual Patching, a security policy enforcement layer that prevents the exploitation of a known vulnerability in a timely manner, even if a patch is not yet available.

Broader Impacts: Data-center scale computing is rapidly becoming the norm for modern computing, yet security and administrative tools are struggling to scale up from a single machine to a rack or data-center.  The S2OS project shows how to leverage and extend software-defined infrastructure to build security management solutions at scale.  The project has supported the training and research of seventeen students.  Key software components of S2OS have been released as open source.

Last Modified: 10/21/2022
Modified by: Zhiqiang Lin