The HitchHiker's Guide to High-Assurance System Observability Protection with Efficient Permission Switches
<|reference_start|>The HitchHiker's Guide to High-Assurance System Observability Protection with Efficient Permission Switches: Protecting system observability records (logs) from compromised OSs has gained significant traction in recent times, with several note-worthy approaches proposed. Unfortunately, none of the proposed approaches achieve high performance with tiny log protection delays. They also leverage risky environments for protection (\eg many use general-purpose hypervisors or TrustZone, which have large TCB and attack surfaces). HitchHiker is an attempt to rectify this problem. The system is designed to ensure (a) in-memory protection of batched logs within a short and configurable real-time deadline by efficient hardware permission switching, and (b) an end-to-end high-assurance environment built upon hardware protection primitives with debloating strategies for secure log protection, persistence, and management. Security evaluations and validations show that HitchHiker reduces log protection delay by 93.3--99.3% compared to the state-of-the-art, while reducing TCB by 9.4--26.9X. Performance evaluations show HitchHiker incurs a geometric mean of less than 6% overhead on diverse real-world programs, improving on the state-of-the-art approach by 61.9--77.5%.<|reference_end|>
@article{zhang2024the,
    title={The HitchHiker's Guide to High-Assurance System Observability Protection
  with Efficient Permission Switches},
    author={Chuqi Zhang, Jun Zeng, Yiming Zhang, Adil Ahmad, Fengwei Zhang, Hai
  Jin, and Zhenkai Liang},
    journal={arXiv preprint arXiv:2409.04484},
    year={2024},
    doi={10.1145/3658644.3690188},
    archivePrefix={arXiv},
    eprint={2409.04484},
    primaryClass={cs.CR cs.OS}
}