Schneier on Security

Nick P • May 19, 2011 3:41 PM

@ Clive Robinson

Yeah, the problems in all my desktop designs start with x86 architecture itself. We have SMM mode, real mode, protected mode, an unusual ring security implementation, segments (often unused in many OS’s), DMA, ultra-high-capacity cache-based side channels, bloated firmware, and errata in security-critical processor components. IF we can make a mostly secure x86 kernel, we’d still have to rebuild it for each choice of chip, firmware and hardware to counter the security issues they impose.

Earlier I was re-reading Paul Karger’s Retrospective on the VAX Security Kernel (free online via Google). He goes into detail describing the design elements and the processes that were required for the system to reach what was considered high assurance at the time. One of the first things I noticed was that they incorporated microcode changes into the design regularly, thanks to how flexible the VAX processor’s microcode was. They used these microcode changes to make an unvirtualizable processor into a decent TCB for their hypervisor.

A retrospective on the VAX Security Kernel
http://cs.dartmouth.edu/~cs38/resources/local/vmm.pdf

I think Gemini Computers did the same thing with x86 when they designed their A1-class GEMSOS OS. I don’t know if I told you Clive but I finally got around to contacting Aesec, current owners of GEMSOS. They quickly responded with information about current and expected future capabilities. From what I gather, the original x86 GEMSOS platform must have had custom firmware because they are currently trying to work out a deal with Intel to do this on one of their new platforms. This is also necessary because their OS’s security is tightly integrated with x86 features like segments.

You know, I don’t see us getting a secure x86 or whatever anytime soon. I think someone wanting that needs to roll their own hardware or build a custom CPU like the Magic-1 machine. There are certain cost and performance considerations, of course, but Magic-1 hosted a web site and runs tons of applications.

Magic-1 homebrew CPU
http://www.homebrewcpu.com/

I honestly keep thinking I should just try to get the software from one of those old B3 or A1 OS builds, get/duplicate the old hardware, and bite the bullet of loosing some features. For instance, I might just get a copy of the most recent VAX Security Kernel, buy a VAX 8800 processor system, load it with memory, and port some applications to it. A 22Mhz processor didn’t sound like much until I read Karger’s description of what they were doing with it:

“The VAX Security Kernel can support large numbers of simultaneous users. Once… operational, all software development… was carried out on several VM’s running on the VMM on a VAX 8800 system. On a typical day, about 40 software engineers and managers were logged in running a mixed load of text editing, compilation, system building, and document formatting. The system provided adequate interactive response time and is sufficiently reliable to support an engineering group that must meet strict milestones and schedules.”

And today’s IT groups somehow have trouble running 40 application VM’s on a 4-way with 32 2+GHz cores and 32GB of RAM. Maybe we should just build a faster VAX and port the old kernel to the new hardware. Maybe use some of the more security-centric FPGA’s and OpenCore designs to speed it up. I’d bet money that it would cost us less and happen faster than Intel making their hardware secure. Hopefully, Intel will at least use their newly acquired Wind River technology, like the separation kernel or RTOS, to improve the security of their platform. There’s been some speculation that they might do this but I don’t think we should hold our breath.