Assistente AI
Trascrizione
00:10:800alessandro.brighente@unipd.it: Hey, hi! So I updated the figures that we had last time related to different super momentization.
00:19:660alessandro.brighente@unipd.it: So now we have meet interactive, remote session which is the the first phone that we see right generates now. So send it to the approval configuration and approv
00:37:410alessandro.brighente@unipd.it: secure pros configuration. You can send it back
00:40:750alessandro.brighente@unipd.it: to be fired together with the challenge we have the interactive set of organization. So you're seeing here that the the very fire sense, and also together we set up a lot of configurations to improve them.
00:58:350alessandro.brighente@unipd.it: Then, the proverb configuration is one configuration from the verify generated.
01:21:810alessandro.brighente@unipd.it: So, looking at the verify at hand only knows where there are, which is well in the end cares about.
01:34:210alessandro.brighente@unipd.it: And then we have the non interactive, remote station. Well, we have another station trigger here. Approval. So the verify this not send amounts up so when to generate a new group.
01:52:30alessandro.brighente@unipd.it: okay? And the way you can do that is to generate now. So extract this configuration and do send a secure proof back to the very 5. And then we have no interactive set promo decision.
02:08:120alessandro.brighente@unipd.it: Basically, what's different from the previous one on the has a set of about configuration.
02:22:360alessandro.brighente@unipd.it: Okay? And again, we have to sign when to create these sessions token and send it back to the
02:41:220alessandro.brighente@unipd.it: through. Verify for verification.
02:45:120alessandro.brighente@unipd.it: Okay, so
02:50:330alessandro.brighente@unipd.it: not today. We'll see how we can formally verify remote station. So we said that the remote decision itself has a protocol. Right has a set done set of features that we would like it to have, or certain set of behaviors that we would like to.
03:07:980alessandro.brighente@unipd.it: Okay. So the we'll see a part of we raised which is verified with the station for single embedded devices. Okay, so we'll go through the list of features that would like to have. And behavior we would like be device to perform when from a remote decision. And then we'll try to to to
03:31:630alessandro.brighente@unipd.it: to design a phone model such that whatever protocol, remote decision protocol that we would like to test and verify can be given as into this verification model, and can be validated for its security. Together with the with this theoretical framework, we will also like to have an idea on how we should probably implement that. So
03:55:500alessandro.brighente@unipd.it: in order to guarantee the different security robots that would seem for remote station. We will Ceos in here. We cannot do that entirely. Be a software. And we cannot either do that entirely via hardware. Okay? So the base also proposes an architecture for a low end embedded device.
04:16:940alessandro.brighente@unipd.it: So you see that basically, we have a hybrid demo decision protocol which considers both software and hardware of course, get different features the the hardware that we would like to add them is it. Of course, it needs to be simple, right? Or it needs to be local.
04:39:250alessandro.brighente@unipd.it: So instead of relying too much on hardware we also use soft. So basically, this is, say, why do we want to use a hybrid approach? Because if we were to do that just via hardware, it would be costly, would make no sense for all of the devices.
04:54:640alessandro.brighente@unipd.it: On the other hand, if we do not include some hardware components for for secure storage. For instance, then we cannot have, the full security proof that remote extension.
05:08:40alessandro.brighente@unipd.it: Okay, so we divide into its 2 basic modules. Okay? Which are basically a hardware module which will, we will denote as if not remote.
05:22:990alessandro.brighente@unipd.it: And the software implementation, which is these, as the app okay, which the most executing station. And these are 2 modules, the hardware software components, the the provers behavior. Okay, and the specify how the provider should behave. You know.
05:44:540alessandro.brighente@unipd.it: formally very fine, secure, remote transition protocol
05:49:100alessandro.brighente@unipd.it: so we of course, as we said before, the hardware module and the software module have different roles, right? Based on the Security Department should enforce. And we have that the hardware module enforces the access control to to pay which we as we've seen before, key this secret value the progression have, in order to create authenticated and valuable decision, token.
06:18:510alessandro.brighente@unipd.it: and part of more. The hardware module needs to ensure the secure and atomic execution of the software components.
06:31:250alessandro.brighente@unipd.it: Okay, so just as a reminder atomic execution means that the plan we start executing the the software component. We shouldn't have no interrupts, okay? Or nothing that basically modifies the flow of execution. So we want to start it from the beginning up to the end without interruption. And that should be because of the while we can guarantee security.
06:54:360alessandro.brighente@unipd.it: Then we have software one and set is responsible for computing the token that we should send back to the challenger in order to validate the the integrity of the manager, or whatever component we would like to
07:16:460alessandro.brighente@unipd.it: load this in the IoT device.
07:21:260alessandro.brighente@unipd.it: How do we create these a 4 month model. How do we describe the organization? And how do we describe the security market as well? What we haven't been raising is that we use
07:34:390alessandro.brighente@unipd.it: a combination of different techniques. We use model checking
07:40:580alessandro.brighente@unipd.it: right? Behavior.
08:02:870alessandro.brighente@unipd.it: So this is something that has not been by itself. Proposal by the race is something that comes from theoretical computing. Okay? And usually, whenever we want to formally verify
08:20:100alessandro.brighente@unipd.it: for my verified protocols for computing in general, we have 3 basic steps
08:24:750alessandro.brighente@unipd.it: so we need them to describe the system via phone and model. As I mentioned before, we can use a final State machine to describe the different states of the remote position protocol, and how we can transition from one State to another, according to which logic.
08:40:00alessandro.brighente@unipd.it: Then we need the a set of properties, and we need to formally model how? How the model should not satisfy this properties.
08:52:590alessandro.brighente@unipd.it: And and once we have up all of this, we have that the system itself of the thing that we want to validate must be proved or checked against these finances, machines, and set the of properties that we defined.
09:10:690alessandro.brighente@unipd.it: So these the final step checking can be achieved. In 2 different ways we have either theorem proving or we have all the checking
09:21:410alessandro.brighente@unipd.it: we use multi checking because so we we put the effort into creating this final state machine and these different logic, and how it should be able logical points in time. So as you can imagine, we have something that can that can be written in form of a a computer program? And which we can compare our implementation of our monetization problem.
09:47:970alessandro.brighente@unipd.it: so we want to create these these logics, right? Particularly. We care about
09:55:900alessandro.brighente@unipd.it: linear $10. And we need some formulas in order to specify these logic, right? Because we want to understand, what are the conditions that define a specific state, and how we should transition to our condition, and what operations these? In the execution of the monetization quote.
10:17:830alessandro.brighente@unipd.it: So in general, we kind of present the system by that triple that you have. S as 0 and P.
10:25:170alessandro.brighente@unipd.it: We have S that represent the final set of say, we have a 0 which is a set of possible initial States, it should be longer to the set s, and then we have t, which is the transition relation side. Okay? So as you see this is fine
10:43:460alessandro.brighente@unipd.it: or the product the potential product? Yes, between the tool set of safe right, because it needs to define how we transition from any industry to any other save. Okay, so this is the transitionization set
11:02:540alessandro.brighente@unipd.it: and good. So we want to represent the Via these transitions and via these the States. How? They're both decision broad behaves and should behave in terms of security.
11:19:130alessandro.brighente@unipd.it: We have different ways in implementing okay, implementation in terms of code. We'll just take a look at the logic on how these should be implemented
11:42:90alessandro.brighente@unipd.it: so, despite of the coding itself Newest Vietnam uses Lena Temple. Logic is at the end and so all the properties that we've seen that we've seen the sign for the organization that will see
11:58:90alessandro.brighente@unipd.it: should be described in logical way. Okay, so with these logic, we have, a sector of propositional connective. We have the conjunction, which is better
12:14:780alessandro.brighente@unipd.it: caps somehow. Decision itself.
12:32:500Then L. Seattle itself also includes some
12:38:440alessandro.brighente@unipd.it: to stop me. Sequential and reasoning. What does that mean? It means that we need to understand certain conditions that through the whole through for
12:47:920alessandro.brighente@unipd.it: for the protocol. Okay? So for instance, we want a set of property to be preserved as long as the software component is run. Or we want the certain properties that depend on the execution that we had in the previous thing. Okay, so we need the at least temporal connectives.
13:11:50alessandro.brighente@unipd.it: And you find these kind of of connected with connectivity. And both letters. Okay? So when we have access we denote the next operation
13:27:740alessandro.brighente@unipd.it: which basically holds if this is the same fee is true at the next system. State. Okay? So, for instance.
13:35:860alessandro.brighente@unipd.it: we would like to see whether the program counter is inside the memory region that contains the software of the station. Right? So, for instance, we want for automicity in the program counter to be inside this region every time. Yeah, it's executing or proceeding in the execution of the software component. So this is an important thing, right? When we want these statement
14:00:710alessandro.brighente@unipd.it: at the next system state, unless the software component as well page.
14:07:840alessandro.brighente@unipd.it: And then we have a app which the notes the future component which basically holds true. If there's a if there exists them in the future a state where the statement fee needs to.
14:21:00alessandro.brighente@unipd.it: Then we have Jean. It's the notes globally which basically goes through if forward future state. So the statement fee is true, and then we have you to see zooms basically it denotes the deal.
14:42:10alessandro.brighente@unipd.it: And what does it mean? It was through, if there's prior to that, okay? So we have been so
14:55:120alessandro.brighente@unipd.it: basically, being 2 different logical statements. Thanks to these these, you
15:02:380alessandro.brighente@unipd.it: okay, so
15:04:850alessandro.brighente@unipd.it: if you track implementation on how? Svm, Smb, works is, you need to define the idea specification, thanks to these rules, and those are the statements. And then you have a Binary State machine that you want to
15:20:320alessandro.brighente@unipd.it: to test against the these logic statements. Okay, if the final state machine actually implements these logical statements that you have, then you have, certain properties that are guaranteed. I'm particular if, the way this trial provider multiple guarantees certain security feature. If we implement, a final save machine that we can compare to this idea and check against this idea. And have.
15:46:680alessandro.brighente@unipd.it: I will result a match. And it needs double finances. Machine is actually implementing and secure the mobileization protocol.
15:56:20alessandro.brighente@unipd.it: So again, we want to check some more of the upper side capabilities. Right? It's a bit of a refresh, but also something a bit new, so we can see there, and adversity. Whenever allow me talk about the adversary. You might use these and we assume the diversity can control the entire software state and the proverbs itself.
16:23:440alessandro.brighente@unipd.it: The person we can modify any writable memory. These, used by the by the proverb, and really memory that is not the explicitly protected by some access control rules in order to to diss that we will leverage the hardware component.
16:41:00alessandro.brighente@unipd.it: And basically, this means that the mercury can read the whatever memory it's not exclusive protected by the hardware mortgage itself.
16:51:250alessandro.brighente@unipd.it: University can relocate the malware from one memory segment to another. It means that the adversary has to control the device. Right? So, for instance, it can occupy again a space in a memory with its malware and at any point in time it can move it around and sort it in different memory regions.
17:14:89alessandro.brighente@unipd.it: these, of course, to avoid being technically and this person may also be in control of direct memory access in the proven. This is something that we didn't even have before. Right? So Wednesday, we've seen that we didn't see the direct memory access
17:33:720alessandro.brighente@unipd.it: instead. Now we want to consider that and want to be secure also in the case where we have direct memory access. Remember that direct memory access might mean that the person has a higher capabilities in terms of sending interrupts, or in terms of reading the content of the memory when it's not supposed to. Okay. So we want to take this thing into account as well.
17:57:790alessandro.brighente@unipd.it: Good. So we want to define. We want to start to find the logic on how the should work in terms of security. And so we start defining some verification options.
18:13:200alessandro.brighente@unipd.it: So we have the first one anyone which is related to to the pro account. And this says that the program counter always contains the address of the instruction being executed in an even cycle. Okay? So somehow, this is something we assume, it needs to be this right. The device working device is doing exactly what it supposed
18:36:110alessandro.brighente@unipd.it: to be doing in terms of pro account. And so whatever we need from the pro encounter gives us the exact indication of the the memory address where it's stored, the the instruction that we are
18:48:130alessandro.brighente@unipd.it: executing the given cycle. We have a second accent, which is really the memory office
18:54:720alessandro.brighente@unipd.it: and it says that whenever the memory is ready, then, or we have a which contains the address of the corresponding memory location. And then we have 2 weeks in here that we call our Yan in Wien which basically are that we should set the if we want to read the or write the dead segment of the memory as part
19:26:160alessandro.brighente@unipd.it: of the mem.
19:27:210alessandro.brighente@unipd.it: Okay? So this is somehow part of the enforcement of given logics inside the and the computing device itself.
19:39:80alessandro.brighente@unipd.it: Then we have a third actions which is related to direct memory access, and this action tells us that whenever we have a Dma Controller that wants to access the the main system memory, we need them a signal for that. As well, okay, we have a Dma out to signal that we denote which basically reflects us the address of the memory that the Dma itself
20:08:490alessandro.brighente@unipd.it: one of boxes.
20:10:770alessandro.brighente@unipd.it: And then we have which must be set again because we want this week to control whether this is something possible or not. Okay? So we have. We have these beat that if set to logic at 0, then give me access is not possible. One. Give me access possible.
20:36:170alessandro.brighente@unipd.it: We have the fourth action, which is about then, what does it say? It says that at the end of a successful reset team. We have the 4 registers, including the program. Calendar itself, are set to 0
20:55:920alessandro.brighente@unipd.it: before the device starts up for zoom. The the normal operation. A normal institution flow the by the hardware components of the the Mcu
21:10:650alessandro.brighente@unipd.it: so we have no ways of modifying there.
21:13:890alessandro.brighente@unipd.it: Okay, this is important. We, this is something that we need our device to do. It is not something that we create, but we want to use a device that guarantees these kind of access, all of them in the end. Okay, and then we have the fifths which is related with the Internet.
21:33:380alessandro.brighente@unipd.it: And it tells us if we need to have seen them in particular, the Irq they're not seeing the not seeing them. And if this is said, it means that we actually have an interrupt, and we stop the execution flow to do whatever the interrupt does, we should be doing
21:55:930alessandro.brighente@unipd.it: so. We said that we want a device that guarantees all these 5 accents.
22:01:950alessandro.brighente@unipd.it: Because basically, it's something that we need in terms of security in terms of good execution. Call in terms of guarantees.
22:10:320alessandro.brighente@unipd.it: But it's not something that we can create on any device, right? Or maybe it's not that easy to to modify the device to to be doing the same. So we we can use some already available devices. That, there are these these 5 actions? So you have an example in 4 30 which is rather mcu still it guarantees these 5 actions
22:39:620alessandro.brighente@unipd.it: you have a link in there. If you'll if you will click on the on the name, you will see the media page with the description of the architecture and history and whatever you want.
22:51:540alessandro.brighente@unipd.it: and then we want to use. A secure implementation on the go
22:57:730alessandro.brighente@unipd.it: as we said last time, if you want to implement the phone security algorithm and we don't necessarily create something new from a cryptographic perspective. That, it makes sense to use a cryptographic libraries that are already validated. Right? So, for instance.
23:15:880alessandro.brighente@unipd.it: if I want to to generate a key from an elliptic curve, this is not something that I would write my even quote for doing that. But our library is identified that can do this
23:28:370alessandro.brighente@unipd.it: and that are secure against certain attacks. So, since we are not proposing a new key derivation function, it makes sense for us to use a lot of it, particularly here, since we're talking about the
23:40:100alessandro.brighente@unipd.it: integrity or message indication quote, it makes sense for us to use a library that is really available. And in particular, we use these apps? Part, okay, yeah, yeah, most in there, you you have a link. You can check how these this call looks like on how
23:58:550alessandro.brighente@unipd.it: is implemented. But basically our software at the station component uses the A HA. Start from these uses. H. Mac, 56 function from these libraries.
24:15:220alessandro.brighente@unipd.it: Okay, so why do we want to do that? Because if we use something that is already validated, we do. We do not need to do that right? So for instance, we you see that these are libraries are written. Can we translate them in? See? Okay? So we'll see. You need to have a compiler. So if all of these are already validated, for instance, we can assume the compiler is doing exactly what it's supposed to do right, and we don't need to validate
24:41:900alessandro.brighente@unipd.it: the the compiler itself, or we can trust the fact that the the compiler preserve of semantic behavior with the functions that we are implementing with that code.
24:53:00alessandro.brighente@unipd.it: Then we have, other tool actions in here that are not directly implemented by the Ms 430 we have the 6 one which is the police, save register which basically tells us that any register touched up in a function is streamed by the port.
25:11:970alessandro.brighente@unipd.it: When the function becomes okay, we execute the function. When this is done, we clean up the register function. And then we have a 7, which is a monthly conservation which again relates to the the the function in there, and the the fact that they are product implemented.
25:30:500alessandro.brighente@unipd.it: In particular. Here we talk about the functional productness of the H. Mac, algorithm, percent of the when these photos have been converted in see and compiled on the device.
25:44:250alessandro.brighente@unipd.it: Good. So in terms of like
25:46:590alessandro.brighente@unipd.it: first week. Not have everything already available on the Mcu, because we said that we want to have some interrupt signals. We want to divide the memory content the way we prefer of doing that. So we have an architecture. And here we have an architecture that again can be translated into a final state machine, and described by at the end of 4 5 So
26:13:540alessandro.brighente@unipd.it: you see that we have, a basic Microcontroller Union architecture. You have the call you have different memory banks. You have different signals
26:23:780alessandro.brighente@unipd.it: on top of this or along the with this architecture we we had them the hardware module. That is the part that we need them in order to secure
26:37:580alessandro.brighente@unipd.it: into the
26:41:330alessandro.brighente@unipd.it: and see the
27:09:450alessandro.brighente@unipd.it: bring it back with auto settings for this or something like that.
27:15:910alessandro.brighente@unipd.it: You said, thanks to the to the logical signal that the hardware module receives, input, we have access control over memory contents. We have, read and right operations that are controlled by the the hardware module we have. The atomicity of the software component is guaranteed by the hardware module itself. Okay? So it's playing and we are sending it.
27:50:60alessandro.brighente@unipd.it: You also see that the
27:52:810alessandro.brighente@unipd.it: in there. Okay? And this is something that we actually need in order to to enforce that these components are not modified somehow
28:24:80alessandro.brighente@unipd.it: in Texas.
28:27:10alessandro.brighente@unipd.it: Then
28:30:830alessandro.brighente@unipd.it: in order to go through the logical part of them. I know that you can not read them now, and I'm not going to to read the whole table. But this is basically give you a reference. So whenever you're when you would be reading slides, or when you will
28:48:360alessandro.brighente@unipd.it: be checking how things work. You kind of disable to have something faster. Okay, you have already the notation here. So when you see a formula with a weird symbol, you don't know what it means. You can go to the same. Okay? So you see that we have something that we already seen the program count there, and some of the logical something really important that we we need to be managing now
29:12:900alessandro.brighente@unipd.it: actually be
29:32:950alessandro.brighente@unipd.it: function and we also saw in here the challenge sent by the challenger.
29:42:910alessandro.brighente@unipd.it: then the we don't need that. We need them. But to remember, you just need. They are in the amount for the time being.
29:57:530alessandro.brighente@unipd.it: Good. So you also have a description of the different notation annotation you see, yet that we define some some dangers both for the addresses of the memory that needs to be.
30:13:560alessandro.brighente@unipd.it: we check them. So yeah. And then we have X
30:32:760alessandro.brighente@unipd.it: region for software station mutation.
30:44:780alessandro.brighente@unipd.it: Okay? So we need these ranges. These are really important, because, when, for instance, we are scanning the memory function. We want to do that sequentially, for instance, or whenever we are running the software component in the SW at the function, we want the program to scan the at the port number. Right? You need to execute all of the instructions
31:04:610alessandro.brighente@unipd.it: stored in there. So these leasing here helps us defining logical constraints, logical things that we want to implement. Okay? So, for instance, the range of value the the program counter itself should assume doing execution of the Association protocol?
31:26:540alessandro.brighente@unipd.it: Again. In terms of annotation, we have a markup address, the address, the source, the results of the each Mac and software component. So Max size, which is the size of each month result. So
31:43:710alessandro.brighente@unipd.it: and then we have the decentation here and also continuous memory regions between A and B. Okay, so it means that whenever we say that, see the long school square brackets, it means that the the value see is smaller even than me. And the
32:04:960alessandro.brighente@unipd.it: okay. So it means that, for instance, the program counter belongs to Cr whenever the current counter is a higher than Crm or smaller something
32:19:340alessandro.brighente@unipd.it: you should have already seen a thousand times, I guess.
32:25:490alessandro.brighente@unipd.it: Hey, let's
32:26:990alessandro.brighente@unipd.it: to a short grade.
32:47:530alessandro.brighente@unipd.it: Good. So we said that when we have the yet the other representation we want to have something to compare with. And so what we what we need to do now, it's so understand how we can create a finance city machine for for our system.
33:05:420alessandro.brighente@unipd.it: And basically what we what do we do when we have? of transitioning between different states? Okay? So the output that we get from the sales and from the Sfm.
33:24:990alessandro.brighente@unipd.it: She depend on the current state. And then we get them on that very same. Okay? So whenever we are exploring again. Save them the way we we behave, is it? Gonna depend on the input that we get
33:42:140alessandro.brighente@unipd.it: for each of our finds save machines. We define a set of inputs which might be a subset of the the one that you've seen there. We have the pro account. We have the Rq we have the in all the different scenes that we've seen before. Okay? And we consider these as the inputs, all the stage qualifying. Okay? Because, indeed, based on
34:08:710alessandro.brighente@unipd.it: on the on this values we might have. I have different different states. So for instance, if we get the Rq. The the interrupt. we definitely go to a save where they can set up happen right then
34:24:510alessandro.brighente@unipd.it: the final say machine, as only one output. Okay? So we will see there is, that is the only one out indicates. Whether and security property as being violated. Okay? So whatever other output we get from the signs and machine it doesn't mean that our security property has to be available.
34:48:620alessandro.brighente@unipd.it: We get to the reset, and we generate. That is, that output means that something went wrong.
34:56:520alessandro.brighente@unipd.it: So what does this mean? Again, we can deem the reset value as well mean. So we have that if value is one, whenever the final state machine to reset state
35:19:550alessandro.brighente@unipd.it: course. Now we have that completed. Okay, so the point. It will be something that triggers
35:44:90alessandro.brighente@unipd.it: leaving these say.
35:47:870alessandro.brighente@unipd.it: And then we have to set the 0 in all other States right, because everything is working fine, and we definitely don't want to to reset the device. If there's only put them in there.
36:02:270alessandro.brighente@unipd.it: Another property that we would like to to have from remote decision is the soundness. Okay, again, is related to all these things that we've signed to. Not
36:12:950so some corresponds to computing and integrating sharing function. So these, Mac, that we've seen before.
36:21:120alessandro.brighente@unipd.it: Over memory a time team. Okay? So a time deal specific time instant we want to test the the memory content and the way we do that is by computing these integration function, which, indeed, the needs Mac in particular. Use the each, Mac. And we computed over the memory region defined by a year.
36:43:80alessandro.brighente@unipd.it: They are with the one time key. Okay, that I from the the master key and challenge these. It sounds really important. Okay, you remember that in the in the we have a key stored in that. Choose the top of the key. But that is not the key that we always use. For
37:03:690alessandro.brighente@unipd.it: for remote decision. Okay, at every decision. Brown, we use a one time key that we generate starting from day this is important for ensuring security might help being the attacker gets the key if you
37:21:630alessandro.brighente@unipd.it: okay. So we have a key to integration function that. That receives a name with Hey? And the challenge and provides us the one time key, and that we should use for that now.
37:35:570alessandro.brighente@unipd.it: Then. The software at the station itself. It's not just a single operation. It's multiple operations, right? We see, you need to derive the key. You need to compute the hash function call. Okay? So these means it's not something. It's not we generate just one.
37:55:690alessandro.brighente@unipd.it: we need just one line in the memory. And we have the result. Okay, so the sound necessarily does not change during the execution of the software station, and in particular during the execution of the H. Mac function. Okay? So these are deals with the temporary consistency.
38:19:190alessandro.brighente@unipd.it: We need to have a certain period of time when we can ensure that the memory content is not changing because we have computing. Basically again.
38:28:610alessandro.brighente@unipd.it: so
38:30:930alessandro.brighente@unipd.it: what is the consequence of these? Or basically, we have the result of the the call of the software association function must reflect the entire state of the memory of the Dmcu at the time when the software Admin function is forwarded. Okay, so it means that we start the execution of software
38:56:220alessandro.brighente@unipd.it: at them. And we need to ensure that
39:00:770alessandro.brighente@unipd.it: nothing is changing during this period of time when we execute that and the the state that we are
39:09:330alessandro.brighente@unipd.it: function. Okay?
39:25:430alessandro.brighente@unipd.it: Good. So it means that we can find Sams, thanks to the to the lodges that we've seen before. Thanks to. Leonard. Thank you.
39:35:510alessandro.brighente@unipd.it: Logic. And you can see that you have. different different manual agents. Different signals is seen here. Right? So you see, for instance,
39:49:580alessandro.brighente@unipd.it: this definition, since the end to end the definition for the sound list of the remote session computation. You have here some basic value. So an amount is any a our value and key derivation function? That, we said before. So you see that what we are asking here is that we see to be, and the address of the the network.
40:17:980alessandro.brighente@unipd.it: and the the designer should not be enabled and we should go through until the PC.
40:28:60alessandro.brighente@unipd.it: If this is okay, then implies this one. Okay? And you see that what you have in here is that the the final state the PC should be.
40:56:310alessandro.brighente@unipd.it: and the the one they team together. With the should be Mac. okay to to generate the attestation tool.
41:06:830alessandro.brighente@unipd.it: Okay? So if these are all through in our final state machine, in our implementation of the the remote session protocol that it means that we have the sound. Okay? And we guarantee the fact that there's no change in the in the memory while we are executing these.
41:26:440alessandro.brighente@unipd.it: Okay? So we'll start defining functions like these for difficulties that we've seen the will like the organization protocol to have.
41:37:420alessandro.brighente@unipd.it: Then in terms of security also, this one is quite plan. So this is something that we've somehow already seen. Right? We have, some assumptions that we've already seen the mutability of the software component and the fact that the key and amongst the keys not known by we have parameter that's given as input. We have the the content of the memory at a certain time.
42:07:250alessandro.brighente@unipd.it: and we have the probability, is all the attacker. And then here you have the remote decision game that somehow we put in sync you see, the 3 basic functions. We have the set up the challenge that is false. And again, the remote decision security definition. Okay, so compared to what we've seen before, this is a bit more structure. But the idea is again the same. The fact that the attacker doesn't know the amounts to keep
42:33:240alessandro.brighente@unipd.it: and the manages to to compromise the It device is able to generate token with the very, very small probability. Okay? And therefore to be in the game with very small probability.
42:49:810alessandro.brighente@unipd.it: Good. So how do we implement this this thing. So looking at the software component of the days, we say that we want to minimize the required feature, because otherwise we mean that we need the additional and possibly costly
43:08:10alessandro.brighente@unipd.it: hardware module. And so we use these hybrid monetization approach. And we could do this. Mac, final software. We already said that we want to drive a new and unique context specific key from the master key. Whenever we need to execute the H. Mac.
43:29:150alessandro.brighente@unipd.it: and so that we use visa library from at start that this software component resides in the data only manually to be and then
43:42:770alessandro.brighente@unipd.it: we have this thing in here that hardware module should enforce that no other software that is running on providers device so can access the memory allocated by the software station. Component. Okay.
43:58:900alessandro.brighente@unipd.it: so these are things that we want to
44:02:480alessandro.brighente@unipd.it: implement our software component. And as you see in here. The software part is very, very simple 5 lines of code or something. Okay.
44:14:850alessandro.brighente@unipd.it: and you see that you have the the different different functions you have. On a low end device. When we have some, we have the keys, we have the key derivation function. We have the and each Mac in here, and then you have the the memory ranges to to be attested.
44:37:600alessandro.brighente@unipd.it: Okay, this is, tell you that the you see that the software component might indeed be very, very simple. Why is that so? For instance, because we are we have a line distrib H. Mac function like we said it'd be
44:57:410alessandro.brighente@unipd.it: we aligned the library because has been, formally very fine. And therefore what we need to do is just to take the number of accountants that we are interested in. Computing the key computing the the the decision and send it back to the
45:14:270alessandro.brighente@unipd.it: you may.
45:17:880alessandro.brighente@unipd.it: It's important.
45:22:110alessandro.brighente@unipd.it: CPU of the Controller to tell to send back the the charge. Okay.
45:28:760alessandro.brighente@unipd.it: very simple. And we can have a dedicated manual space for this.
45:36:90alessandro.brighente@unipd.it: How do we define the the functional product productness of these software components? Well, you see again, that we have the different memory features that the program should have where the challenge should be store. The fact that we shouldn't have reset the or interrupt signals to be set up we have the key regions to contain and the key
46:05:660alessandro.brighente@unipd.it: and this should go through
46:08:330alessandro.brighente@unipd.it: up to the point where the PC. Gets to share much, which is the last we have there. SW, add on it, and if this is the case you see that we have this thing in here the final state
46:23:410alessandro.brighente@unipd.it: which basically tells us that the the pro account got to the final address, Cr. Max.
46:30:180alessandro.brighente@unipd.it: and that the memory region where we store they, they have decision toker produce the evaluation token based on the function function. And m.
46:41:640alessandro.brighente@unipd.it: okay, so here you have the this thing here translated into
46:47:420alessandro.brighente@unipd.it: not language. Okay. So again, what we have in here is, if the memory content is, always preserved up to the point wherever we see. Get to see a Max that will get response right? Nothing is changed. And the the memory content.
47:15:260alessandro.brighente@unipd.it: Then we said that we don't want the virtually to be able to access that the master key copy that we have in there. If that would be the case, if the attacker manages to to extract the key from the hardware, then what do we do?
47:32:820alessandro.brighente@unipd.it: At the Charles right is has the key can derive the new case, and can or force the results somehow.
47:43:870alessandro.brighente@unipd.it: So the hardware module itself. Contains, an access control function access control module that enforces the key to be only be accessible by the software components. Cell. Okay. Only if the request comes from SW active, then then the key can be accessed.
48:05:780alessandro.brighente@unipd.it: Okay, and this is something that again, we can rise up in terms of as yet.
48:13:610alessandro.brighente@unipd.it: Okay? And you see it in here. Okay, you have the translation of that term equation into natural language. Okay? So we said, it's 6, 10 months.
48:30:870alessandro.brighente@unipd.it: yeah. So it says that the only we should have a receptor. Okay, enable the there's a function whenever there's for the outside. The from Cr, say that, do you see? The memory region where we have the the software authorization part
48:48:510alessandro.brighente@unipd.it: component. Whenever we have a brand conference outside of that tries to read the from the address, which is the part where we have the key, then we should figure it right. Something else is trying to access the key and should not be
49:04:180alessandro.brighente@unipd.it: be able to do that right. And if eventually, somehow, it gets to something that might trigger accessing. The the key number is that
49:16:230these can be can be translated into finance state machine.
49:21:950alessandro.brighente@unipd.it: Okay? So the the access control module sub module of the hardware component, they've been described as this thing in here. You see that we have 2 States. We have the run, and we have the reset. And you can see that the from ron when there is that it's not
49:50:930alessandro.brighente@unipd.it: they're not safe. Right? So the normal model of operations.
49:57:760alessandro.brighente@unipd.it: Okay? So indeed. In order to implement what we said before in terms of security of not being able to access. The key in simple final state machine is that. We don't want to. More than that. And in particular, you see that we are creating a finite machine for a simple operation, right? For a simple component of the overall.
50:19:30alessandro.brighente@unipd.it: Okay, so we'll have different final state machines with their logic that should implement different security properties
50:28:290alessandro.brighente@unipd.it: of the remote decision road.
50:31:110Then.
50:33:00alessandro.brighente@unipd.it: indeed! Here you have the Rtl
50:37:10alessandro.brighente@unipd.it: and yeah, formulas and specification for 2 other which are the execution of the software component. And then we have the controller invocation. Okay? So you can check that. These equations are in 2. We're going to to go through all of them one by one.
51:02:410alessandro.brighente@unipd.it: So the first one
51:04:790alessandro.brighente@unipd.it: I. So we are dealing with the the okay. So what does it mean? It means that we should not go outside from the the memory cr, while we are executing as the app.
51:21:610alessandro.brighente@unipd.it: Okay? So we do that by checking the current. And next program counter values right? Because we know the values that the program counter should assume.
51:31:790alessandro.brighente@unipd.it: While we are scanning and then if we have something like the current PC value is within the Software Association region, and the next PC value is out of the software positioning region. Then we have the either the current PC value is the address of the last instruction.
51:54:100alessandro.brighente@unipd.it: which is fine or it means that something weird is going on. And we should trigger a reset. Okay? Because something, someone in order to break in and execute other code. It means that the program counter should point to an address in the memory that it's not the within
52:18:960alessandro.brighente@unipd.it: the boundaries of Cr, and therefore and nothing good.
52:27:690alessandro.brighente@unipd.it: Then
52:29:750alessandro.brighente@unipd.it: visa is the second specification that you've seen in size, and what is doing is basically important. The fact that the the only way for the program counter to enter the the memory part. But the software of the station
52:44:660alessandro.brighente@unipd.it: for this form is through the very first instruction which is stored on in Crm, okay, it means that the controlling location, the fact that we shouldn't start up as from the very beginning. And there's another way of executing that the other than starting from the very beginning. So from crme.
53:04:820so
53:06:720alessandro.brighente@unipd.it: these and the previous invariant, which is the visa at the specification together. Imply that this thing it is impossible to jump up into the middle of the execution of the software at the station call. Or to leave the software code before reaching the last instruction. Okay, basically should be executed from the beginning to the end without any interruptions. And so these 2
53:36:30alessandro.brighente@unipd.it: specifications, we actually ensure that.
53:41:510alessandro.brighente@unipd.it: And then we have. The ethnicity! Which? Can be ensured by these farther specification here? And yes
53:53:750alessandro.brighente@unipd.it: so we have that. Maybe. Interrupted right? If we have new setup, it means that we saw the execution of software but with these specific as yet, we prevent the interrupts to be trigon is executed right, which is very important as well.
54:18:200alessandro.brighente@unipd.it: So now only we want to execute the whole from beginning to the end. But we should prevent other things that happens in there. And this surrounding the software execution to stop the flow of the execution.
54:33:700alessandro.brighente@unipd.it: And these are.
54:37:810alessandro.brighente@unipd.it: These are just specification that if they interrupt, sir, are not disabled by the software itself running on the proverb before. Only SW active. Then, we have that interrupts that might cause interruption with execution of SW, actually figure reset. And let me see, what is that? Okay? Because there's something
55:03:290alessandro.brighente@unipd.it: we are not going on, and we don't want to do that.
55:06:490alessandro.brighente@unipd.it: So the verified model for all of these things that we send out for these 3 specifications can be described by a final save machine with 5 states.
55:18:760alessandro.brighente@unipd.it: We have 2 basic states that we call not not cr and mid cr
55:25:560alessandro.brighente@unipd.it: which represents movements of the program counter to an address which is either outside the Ci, not cr or meet Ci within the cr, okay? So the memory that contains the software component.
55:41:600alessandro.brighente@unipd.it: And then we have to all the save which are first of cr, and not cr, this representing these, save when the chrome account there wants to the very first instruction of the software. But components. And then we have. Of course there is a safe like you said that whenever there's something weird and we want to visit, we should be able to in there.
56:03:500alessandro.brighente@unipd.it: We had transitions to the United States. Is group basis
56:08:530alessandro.brighente@unipd.it: the first one is when and sequence events from current calendar does not obey to the aforemention conditions, right? So when it's the fact that the should not point to an angry
56:24:710alessandro.brighente@unipd.it: value which is assigned cr, if we are not at the very last structure.
56:30:570alessandro.brighente@unipd.it: And then the second condition, when we transition to the set that might happen is when they they interrupt this also queue while executing the software decision phone, right? So meaning that there's an interrupt might stop. Execution of the software decision form.
56:48:500alessandro.brighente@unipd.it: This is the final state machine that you get out of all this. So you see there before, out of states that deal with the with the value of a product being in the inside the cr, then you have, all the logical functions that we see at the end that the 3 pairs transition in between State and another.
57:11:530alessandro.brighente@unipd.it: And then we have a transition tool. That is that same when the technological conditions defined by these equations are not metal.
57:23:670alessandro.brighente@unipd.it: Okay?
57:24:920alessandro.brighente@unipd.it: So of course, there are also other parts to to create the whole system while we don't go through all them. Zoom was just so to give an example on how we can create secure code to create secure protocols and how we can formally validate them
57:44:550alessandro.brighente@unipd.it: these conclusions, of course. So I will see you at the accent regarding the the the the projects I will release them in
57:57:40alessandro.brighente@unipd.it: between today and the and the coming couple of days. So you will have them. If you have any questions, of course you can either send me an email, or ask now, or
58:09:630alessandro.brighente@unipd.it: whatever you prefer.