Flicker: an execution infrastructure for tcb minimization

We present Flicker, an infrastructure for executing securitysensitive code in complete isolation while trusting as few as 250 lines of additional code. Flicker can also provide meaningful, fine-grained attestation of the code executed (as well as its inputs and outputs) to a remote party. Flicker guarantees these properties even if the BIOS, OS and DMAenabled devices are all malicious. Flicker leverages new commodity processors from AMD and Intel and does not require a new OS or VMM. We demonstrate a full implementation of Flicker on an AMD platform and describe our development environment for simplifying the construction of Flicker-enabled code. Categories and Subject Descriptors K.6.5 [Security and Protection] General Terms Design, Security Keywords Trusted Computing, Late Launch, Secure Execution ∗ This research was supported in part by CyLab at Carnegie Mellon under grant DAAD19-02-1-0389 from the Army Research Office, and grants CNS-0509004, CT-0433540 and CCF-0424422 from the...

• Type: Conference
• Year: 2008
• Where: EUROSYS
• Authors: Jonathan M. McCune, Bryan Parno, Adrian Perrig, Michael K. Reiter, Hiroshi Isozaki
• Keywords: Carnegie Mellon, EUROSYS 2008, Flicker Guarantees, National Science Foundation, System Software