Software supply chain security is an essential area of cybersecurity, as shown by attacks such as the XZ Utils incident in 2024. Software Bills of Materials (SBOMs) were introduced to keep track of the supply chain of a software artifact. They have been brought to widespread attention in 2021 through US Executive Order 14028. The EU will make SBOMs mandatory by 2027 with their Cyber Resilience Act from 2024. In contrast to these demands for SBOMs through legislation, practitioners struggle to make real use of them. Multiple recent studies have concluded that adoption of SBOMs and their integration into security processes are facing various challenges. At the same time, accuracy and correctness problems of SBOMs generated by wide-spread tools have been shown. Based on this situation, the dissertation research is dedicated to the research question: What benefit do SBOMs provide and what further benefit can they potentially provide for supply chain security? In order to answer, this research description introduces four intended contributions: (1) First, all knowledge about the history of SBOMs and related concepts in Computer Science is systematized. (2) Second, an SBOM usage model that provides an abstract view on the software supply chain as well as actors involved in it is developed. The goal of the model is to give a theoretical foundation for making practical use of SBOMs. (3) Third, with BOM2VULN an analysis of current tools that map vulnerabilities to SBOMs is conducted, potentially including the introduction of a new tool for this task. The goal is to provide security engineers with a means of quickly finding vulnerabilities and assessing their relevance. (4) Lastly, the SBOM Nutri Score is proposed including an evaluation. The score helps practitioners to evaluate the software supply chain risk of third party code they use or intend to use.
Man-At-The-End (MATE) attackers operate with full access to software or hardware targets and can observe, analyze, and modify running systems to extract secrets or alter behavior. CheckMATE explores both offensive and defensive research in this space: measurement studies and tooling that expose realistic attack techniques, alongside defenses such as obfuscation, tamper-resistance, watermarking, white-box cryptography, and hardware-assisted protections. This workshop collects rigorous, reproducible research aimed at bridging academic advances and industry practice. The CheckMATE '25 complete workshop proceedings can be found at: https://dl.acm.org/citation.cfm?id=3733817
Most homomorphic encryption (FHE) schemes exploit a technique called single-instruction multiple-data (SIMD) to process several messages in parallel. However, they base their security in somehow strong assumptions, such as the hardness of approximate lattice problems with superpolynomial approximation factor. On the other extreme of the spectrum, there are lightweight FHE schemes that have much faster bootstrapping but no SIMD capabilities. On the positive side, the security of these schemes is based on lattice problems with (low-degree) polynomial approximation factor only, which is a much weaker security assumption. Aiming the best of those two options, Micciancio and Sorrell (ICALP'18) proposed a new amortized bootstrapping that can process many messages at once, yielding sublinear time complexity per message, and allowing one to construct FHE based on lattice problems with polynomial approximation factor. Some subsequent works on this line achieve near-optimal asymptotic performance, nevertheless, concrete efficiency remains mostly an open problem. The only existing implementation to date (GPV23, Asiacrypt 2023) requires keys of up to a hundred gigabytes while only providing gains for relatively large messages. In this paper, we introduce a new method for amortized bootstrapping where the number of homomorphic operations required per message is O(h) and the noise overhead is O(root h lambda log lambda), where h is the Hamming weight of the LWE secret key and lambda is the security parameter. This allows us to use much smaller parameters and to obtain faster running time. Our method is based on a new efficient homomorphic evaluation of sparse polynomial multiplication. We bootstrap 2 to 8-bit messages in 1.46 ms to 28.5 ms, respectively. Compared to TFHE-rs, this represents a performance improvement of 2.5 to 38.7 times while requiring bootstrapping keys up to 47.5 times smaller.
The widespread adoption of Large Language Models (LLMs) is driving the rapidly growing demand for large-scale computations like training and fine-tuning models. In many areas, the confidentiality of the underlying data is of critical importance to their corporate or government owners. However, securing data in large-scale computations is challenging. First, its demand for enormous hardware resources typically requires outsourcing (e.g., to the public cloud). Second, the large and rapidly evolving software stack used in LLM training in conjunction with a growing incidence of supply chain attacks and software vulnerabilities makes it all but impossible for data owners to establish trust in the code that processes their highly sensitive data. Confidential computing and sandboxing are promising techniques for solving these problems. However, existing sandboxes do not address covert channels which limits their ability to protect confidential data. This paper proposes IOVALVE, a novel I/O sandbox for large-scale computations on confidential data. IOVALVE places sandbox enforcement on a programmable network device that is physically isolated from the processor hardware running the untrusted software stack. This construction allows IOVALVE to sidestep the multitude of side channels due to visible or hidden resource sharing. IOVALVE interposes on all network I/O of the sandbox and only transmits encrypted and regularized network traffic in order to prevent information leakage over the network. Our evaluation shows that IOVALVE has marginal performance overhead and supports real-world applications like LLM fine-tuning and batch inference, and molecular simulation.
As the de-facto standard for container orchestration, Kubernetes is extensively adopted by numerous companies and cloud vendors, making its security critical. In this paper, we define a new attack surface called implicit permission: The execution of explicitly granted permissions in Kubernetes dynamically leads to implicit operations on other resources, enabling new permissions beyond the explicitly granted ones. Such implicit permissions create security vulnerabilities that attackers can exploit to compromise an entire cluster. Automatically identifying implicit permissions is challenging due to implicit relation reasoning and dynamic behaviors across diverse components of Kubernetes. To address that, we devise a systematic approach that combines static analysis techniques with the advanced capabilities of the large language model (LLM, e.g., GPT-4.5). Initially, we develop a static analysis to identify all Kubernetes resources. Building on this, we use static analysis to identify all explicit permissions for each resource. Finally, by combining the semantic reasoning capabilities of LLMs with the pattern-based precision of static analysis, we reason about what explicit permissions may dynamically lead to implicit permissions through complex interactions and uncover 593 implicit permissions derived from explicit permissions. We use the implicit permission references as insights to identify potential risks of CNCF projects and applications provided by the top four cloud vendors. With responsible disclosure, we obtain five new CVEs, six acknowledgments of cloud vendors, and a bounty awarded by Google. These acknowledgments underlie the practical impact of our attack.
