Machine learning property attestations allow provers (e.g., model providers or owners) to attest properties of their models/datasets to verifiers (e.g., regulators, customers), enabling accountability towards regulations and policies. But, current approaches do not support generative models or large datasets. We present PAL*M, a property attestation framework for large generative models, illustrated using large language models. PAL*M defines properties across training and inference, leverages confidential virtual machines with security-aware GPUs for coverage of CPU-GPU operations, and proposes using incremental multiset hashing over memory-mapped datasets to efficiently track their integrity. We implement PAL*M on Intel TDX and NVIDIA H100, showing it is efficient, scalable, versatile, and secure.

Hardware-secured remote attestation is essential to establishing trust in the integrity of confidential virtual machines (cVMs), but is difficult to use in practice because verifying attestation evidence requires the use of hardware-specific cryptographic logic. This increases both maintenance costs and the verifiers' trusted computing base. We introduce the concept of self-verifying remote attestation evidence. Each attestation bundle includes verification logic as a WebAssembly component signed by a trusted party. This approach transforms evidence verification into a standard code-signing problem: the verifier checks the signature on the embedded logic and then executes it to validate the evidence. As a result, verifiers can validate attestation evidence without any platform-specific knowledge. We implement this concept as TrustMee, a platform-agnostic verification driver for the Trustee framework. We demonstrate its functionality with self-verifying evidence for AMD SEV-SNP and Intel TDX attestations, producing attestation claims in the standard EAT Attestation Result (EAR) format.

Regulations increasingly call for various assurances from machine learning (ML) model providers about their training data, training process, and model behavior. For better transparency, industry (e.g., Huggingface and Google) has adopted model cards and datasheets to describe various properties of training datasets and models. In the same vein, we introduce the notion of inference cards to describe the properties of a given inference (e.g., binding of the output to the model and its corresponding input). We coin the term ML property cards to collectively refer to these various types of cards. To prevent a malicious model provider from including false information in ML property cards, they need to be verifiable. We show how to construct verifiable ML property cards using property attestation, technical mechanisms by which a prover (e.g., a model provider) can attest to various ML properties to a verifier (e.g., an auditor). Since prior attestation mechanisms based purely on cryptography are often narrowly focused (lacking versatility) and inefficient, we need an efficient mechanism to attest different types of properties across the entire ML model pipeline. Emerging widespread support for confidential computing has made it possible to run and even train models inside hardware-assisted trusted execution environments (TEEs), which provide highly efficient attestation mechanisms. We propose Laminator, which uses TEEs to provide the first framework for verifiable ML property cards via hardware-assisted ML property attestations. Laminator is efficient in terms of overhead, scalable to large numbers of verifiers, and versatile with respect to the properties it can prove during training or inference.

Outsourced computing is widely used today. However, current approaches for protecting client data in outsourced computing fall short: use of cryptographic techniques like fully-homomorphic encryption incurs substantial costs, whereas use of hardware-assisted trusted execution environments has been shown to be vulnerable to run-time and side-channel attacks. We present Blinded Memory (BliMe), an architecture to realize efficient and secure outsourced computation. BliMe consists of a novel and minimal set of instruction set architecture (ISA) extensions implementing a taint-tracking policy to ensure the confidentiality of client data even in the presence of server vulnerabilities. To secure outsourced computation, the BliMe extensions can be used together with an attestable, fixed-function hardware security module (HSM) and an encryption engine that provides atomic decrypt-and-taint and encrypt-and-untaint operations. Clients rely on remote attestation and key agreement with the HSM to ensure that their data can be transferred securely to and from the encryption engine and will always be protected by BliMe's taint-tracking policy while at the server. We provide an RTL implementation BliMe-BOOM based on the BOOM RISC-V core. BliMe-BOOM requires no reduction in clock frequency relative to unmodified BOOM, and has minimal power ($<\!1.5\%$) and FPGA resource ($\leq\!9.0\%$) overheads. Various implementations of BliMe incur only moderate performance overhead ($8--25\%$). We also provide a machine-checked security proof of a simplified model ISA with BliMe extensions.

We present Dolma, which applies dynamic information flow tracking (DIFT) to the Gemmini matrix multiplication accelerator. With the BliMe CPU extensions, it efficiently guarantees client data confidentiality, even in the presence of malicious/vulnerable software and side channel attacks on servers.

Modern computer systems are built out of many different layers: protocols, software, and hardware all work together to make a larger system. Developers use each layer to build the next layer above it.Security engineers can incorporate defences at different layers. Each layer has its own limitations: cryptography can’t be trusted if the software implementing it is vulnerable, and hardware can’t change to adapt to new situations. By combining primitives from different layers, we can produce security mechanisms that are more than the sum of their parts.In this talk, we will show how cryptographic techniques, embedded into software, can protect against memory corruption attacks, and demonstrate how this can protect the return address stack and user data structures even in a vulnerable program.

Personal mobile devices like smartphones and tablets are ubiquitous. People use mobile devices for fun, for work, and for organizing and managing their lives, including their finances. This has become possible because over the past two decades, mobile phones evolved from closed platforms intended for voice calls and messaging to open platforms whose functionality can be extended in myriad ways by third party developers. Such wide-ranging scope of use also means widely different security and privacy requirements for those uses. As mobile platforms gradually opened, platform security mechanisms were incorporated into their architectures so that the security and privacy requirements of all stakeholders could be met. The time is therefore right to take a new look at mobile platform security, which is the intent of this monograph. The monograph is divided into four parts: firstly, the authors look at the how and why of mobile platform security, and this is followed by a discussion on vulnerabilities and attacks. The monograph concludes by looking forward and discussing emerging research that explores ways of dealing with hardware compromise, and building blocks for the next generation of hardware platform security. The authors have intended to provide a broad overview of the current state of practice and a glimpse of possible research directions that can be of use to practitioners, decision makers, and researchers. The focus of this monograph is on hardware platform security in mobile devices. Other forms of Security, such as OS Security, are briefly covered, but from the perspective of motivating hardware platform security. Also, specific high-level attacks such as jail-breaking or rooting are not covered, though the basic attacks described in Part III can, and often are, used as stepping stones for these high-level attacks.

Modern processors include high-performance cryptographic functionalities such as Intel's AES- NI and ARM's Pointer Authentication that allow programs to efficiently authenticate data held by the program. Pointer Authentication is already used to protect return addresses in recent Apple devices, but as yet these structures have seen little use for the protection of general program data. In this paper, we show how cryptographically-authenticated data structures can be used to protect against attacks based on memory corruption, and show how they can be efficiently realized using widely available hardware-assisted cryptographic mechanisms. We present realizations of secure stacks and queues with minimal overall performance overhead (3.4%-6.4% slowdown of the OpenCV core performance tests), and provide proofs of correctness.

Autonomous collaborative networks of devices are rapidly emerging in numerous domains, such as self-driving cars, smart factories, critical infrastructure, and Internet of Things in general. Although autonomy and self-organization are highly desired properties, they increase vulnerability to attacks. Hence, autonomous networks need dependable mechanisms to detect malicious devices in order to prevent compromise of the entire network. However, current mechanisms to detect malicious devices either require a trusted central entity or scale poorly. In this paper, we present GrandDetAuto, the first scheme to identify malicious devices efficiently within large autonomous networks of collaborating entities. GrandDetAuto functions without relying on a central trusted entity, works reliably for very large networks of devices, and is adaptable to a wide range of application scenarios thanks to interchangeable components. Our scheme uses random elections to embed integrity validation schemes in distributed consensus, providing a solution supporting tens of thousands of devices. We implemented and evaluated a concrete instance of GrandDetAuto on a network of embedded devices and conducted large-scale network simulations with up to 100 000 nodes. Our results show the effectiveness and efficiency of our scheme, revealing logarithmic growth in run-time and message complexity with increasing network size. Moreover, we provide an extensive evaluation of key parameters showing that GrandDetAuto is applicable to many scenarios with diverse requirements.

A popular run-time attack technique is to compromise the control-flow integrity of a program by modifying function return addresses on the stack. So far, shadow stacks have proven to be essential for comprehensively preventing return address manipulation. Shadow stacks record return addresses in integrity-protected memory secured with hardware-assistance or software access control. Software shadow stacks incur high overheads or trade off security for efficiency. Hardware-assisted shadow stacks are efficient and secure, but require the deployment of special-purpose hardware. We present authenticated call stack (ACS), an approach that uses chained message authentication codes (MACs). Our prototype, PACStack, uses the ARM general purpose hardware mechanism for pointer authentication (PA) to implement ACS. Via a rigorous security analysis, we show that PACStack achieves security comparable to hardware-assisted shadow stacks without requiring dedicated hardware. We demonstrate that PACStack's performance overhead is small (~3%).

Nonlinearity in many systems is heavily dependent on component variation and environmental factors such as temperature. This is often overcome by keeping signals close enough to the device's operating point that it appears approximately linear. But as the signal being measured becomes larger, the deviation from linearity increases, and the device's nonlinearity specification will be exceeded. This limits the range over which the device will produce directly useful measurements, often to far less than the device's safe range of operation.

Abstract Deniable messaging protocols allow two parties to have ‘off-the-record’ conversations without leaving any record that can convince external verifiers about what either of them said during the conversation. Recent events like the Podesta email dump underscore the importance of deniable messaging to politicians, whistleblowers, dissidents and many others. Consequently, messaging protocols like Signal and OTR are designed with cryptographic mechanisms to ensure deniable communication, irrespective of whether the communications partner is trusted. Many commodity devices today support hardware-assisted remote attestation which can be used to convince a remote verifier of some property locally observed on the device. We show how an adversary can use remote attestation to undetectably generate a non-repudiable transcript from any deniable protocol (including messaging protocols) providing sender authentication, proving to skeptical verifiers what was said. We describe a concrete implementation of the technique using the Signal messaging protocol. We then show how to design protocols that are deniable even against an adversary capable of attestation, and in particular how attestation itself can be used to restore deniability by thwarting realistic classes of adversary.

Game theory is an established branch of mathematics that offers a rich set of mathematical tools for multi-person strategic decision making that can be used to model the interactions of decision makers in security problems who compete for limited and shared resources. This article presents a review of the literature in the area of game theoretical modelling of network/cybersecurity and identifies a number of challenges in this area that need to be addressed.

Consensus mechanisms used by popular distributed ledgers are highly scalable but notoriously inefficient. Byzantine fault tolerance (BFT) protocols are efficient but far less scalable. Speculative BFT protocols such as Zyzzyva and Zyzzyva5 are efficient and scalable but require a trade-off: Zyzzyva requires only 3f + 1 replicas to tolerate f faults, but even a single slow replica will make Zyzzyva fall back to more expensive non-speculative operation. Zyzzyva5 does not require a non-speculative fallback, but requires 5f + 1 replicas in order to tolerate f faults. BFT variants using hardware-assisted trusted components can tolerate a greater proportion of faults, but require that every replica have this hardware. We present SACZyzzyva, addressing these concerns: resilience to slow replicas and requiring only 3f + 1 replicas, with only one replica needing an active monotonic counter at any given time. We experimentally evaluate our protocols, demonstrating low latency and high scalability. We prove that SACZyzzyva is optimally robust and that trusted components cannot increase fault tolerance unless they are present in greater than two-thirds of replicas.

Autonomous collaborative networks of devices are emerging in numerous domains, such as self-driving cars, smart factories and critical infrastructure, generally referred to as IoT. Their autonomy and self-organization makes them especially vulnerable to attacks. Thus, such networks need a dependable mechanism to detect and identify attackers and enable appropriate reactions. However, current mechanisms to identify adversaries either require a trusted central entity or scale poorly. In this paper, we present SADAN, the first scheme to efficiently identify malicious devices within large networks of collaborating entities. SADAN is designed to function in truly autonomous environments, i.e., without a central trusted entity. Our scheme combines random elections with strong but potentially expensive integrity validation schemes providing a highly scalable solution supporting very large networks with tens of thousands of devices. SADAN is designed as a flexible scheme with interchangeable components, making it adaptable to a wide range of scenarios and use cases. We implemented an instance of SADAN for an automotive use case and simulated it on large-scale networks. Our results show that SADAN scales very efficiently for large networks, and thus enables novel use cases in such environments. Further, we provide an extensive evaluation of key parameters allowing to adapt SADAN to many scenarios.

Most satellite communications monitoring tools use simple thresholding of univariate measurements to alert the operator to unusual events [1], [2]. This approach suffers from frequent false alarms, and is moreover unable to detect sequence or multivariate anomalies [3]. Here we consider the problem of detecting outliers in high-dimensional time-series data, such as transponder frequency spectra. Long Short Term Memory (LSTM) networks are able to form sophisticated representations of such multivariate temporal data, and can be used to predict future sequences when presented with sufficient context. We report here on the utility of LSTM prediction error as a defacto measure for detecting outliers. We show that this approach significantly improves on simple threshold models, as well as on moving average and static predictors. The latter simply assume the next trace will be equal to the previous trace. The advantages of using an LSTM network for anomaly detection are twofold. Firstly, the training data do not need to be labelled. This alleviates the need to provide the model with specific examples of anomalies. Secondly, the trained model is able to detect previously unseen anomalies. Such anomalies have a degree of unpredictability that makes them stand out. LSTM networks are further able to potentially detect more nuanced sequence and multivariate anomalies. These occur when all values are within normal tolerances, but the sequence or combinations of values are themselves unusual. The technique we describe could be used in practice for alerting satellite network operators to unusual conditions requiring their attention.

No measurement system is perfect, and two varieties of error compete to frustrate their designers and operators. Random errors produce measurement-to-measurement to variation, while systematic errors result in consistently-incorrect results. The interplay between these two phenomena has been the subject of research for many years, particularly within the area of stochastic resonance , which focusses upon cases where the signal-to-noise ratio of a nonlinear system can increase with the addition of noise to its input signal. While it has been demonstrated many times that noise can overcome systematic deficiencies in a measurement system, there remain open questions on how to take advantage of this in practical systems, what information can be extracted, and whether such ‘randomised’ systems are useful in other settings. In this thesis, we consider this general theme in the context of two main settings: the adversarial, and the nonadversarial. In both cases, there is a significant advantage to be gained from the use of techniques that are adapted to the problem domain, in contrast to previous ad-hoc approaches that have failed to take advantage of the structures of the problems at hand. Abstract Finally, we describe a number of approaches to the topical problems of key distribution and identity verification. We show how various forms of multi-path probing can be treated as a form of random sampling; much like in the first section, this randomness allows for the characterisation of systematic errors, in this case the consistent changes introduced by an attacker. We then compute bounds on the probability that an attacker achieves a deception against a user taking part in this sampling process. The first approach that we consider uses an anonymising system such as Tor or a mix-net; if all users make anonymous requests to a service in lock-step, then a malicious service cannot guarantee a self-consistent set of responses to anyone without providing the malicious response to all users. This allows the development of a statistically guaranteed consensus, and thus permits auditors to assure themselves that they have examined the same data as has been provided to other users. This provides an attractive alternative to blockchain technology, avoiding the complexity of the proof-of-work and proof-of-stake-based systems that dominate the landscape today. We have developed a second approach that allows the random-sampling approach to be used By demonstrating not This provides a basis the

In most designs, residual nonlinearity is considered an inescapable curse-even when it is known to be present, it is often assumed to be too unpredictable or unstable to be dealt with in postprocessing. However, with the aid of outputonly system identification, this is no longer the case. We have developed a new technique for compensation of static nonlinear distortion using the internal noise of the device. It improves upon previous approaches by allowing highly-efficient fixed-point implementation, and represents the first step towards direct integration with analog hardware in order to produce an ADC that is blind to its analog frontend.