Deconstructing MinBFT for Security and Verifiability Vincent Rahli, - PowerPoint PPT Presentation

Deconstructing MinBFT for Security and Verifiability Vincent Rahli, Francisco Rocha, Marcus V¨ olp, and Paulo Esteves-Verissimo http://wwwen.uni.lu/snt/research/critix March 15, 2016 Vincent Rahli Deconstructing MinBFT March 15, 2016 1/15

Meet The Team Francisco Rocha Marcus V¨ olp J´ er´ emie Decouchant Paulo Esteves-Verissimo Vincent Rahli Vincent Rahli Deconstructing MinBFT March 15, 2016 2/15

Overall Story Resilience (fault-tolerance) Security Formal Correctness Vincent Rahli Deconstructing MinBFT March 15, 2016 3/15

Overall Story All services in the kernel Vincent Rahli Deconstructing MinBFT March 15, 2016 4/15

Overall Story Only keep the bare minimum in the kernel Vincent Rahli Deconstructing MinBFT March 15, 2016 5/15

Overall Story Build small/secure/verifiable components on top of Fiasco Vincent Rahli Deconstructing MinBFT March 15, 2016 6/15

MinBFT Byzantine fault-tolerant protocol similar to PBFT 2 f ` 1 as opposed to 3 f ` 1 in PBFT Uses a trusted counter (USIG) Vincent Rahli Deconstructing MinBFT March 15, 2016 7/15

L4/Fiasco Only program that runs in privileged processor mode Small: only has what cannot be implemented as the user level Provides memory isolation Selective trustworthiness (choose what to use at the user level) Vincent Rahli Deconstructing MinBFT March 15, 2016 8/15

L4/Fiasco Multi-processor support System calls using capabilities Communication through synchronized IPC calls L4RE (Runtime Environment) for application development Vincent Rahli Deconstructing MinBFT March 15, 2016 9/15

Designed for Security Small isolated verifiable components Easier/faster to restart Selective rejuvenation Small trusted base: L4/Fiasco Vincent Rahli Deconstructing MinBFT March 15, 2016 10/15

Fast Recovery Vincent Rahli Deconstructing MinBFT March 15, 2016 11/15

Verification What guarantees do we get between VST & CompCert? Vincent Rahli Deconstructing MinBFT March 15, 2016 12/15

Implementation E.g., shared message buffer Vincent Rahli Deconstructing MinBFT March 15, 2016 13/15

Progress so far Designing BFT tasks at the Fiasco level Building and verifying a USIG C task Vincent Rahli Deconstructing MinBFT March 15, 2016 14/15

Thank You! We’re hiring Vincent Rahli Deconstructing MinBFT March 15, 2016 15/15