Overshadow: a virtualization-based approach to retrofitting protection in commodity operating systems

By Mike Chen Tal, G. C. Lewis, Pratap Subrahmanyam, Carl A Waldspurger, Dan Boneh, Jeffrey S. Dwoskin, Dan R. K. Ports, Stanford Princeton, Mit. International Conference on Architectural Support for Programming Languages and Operating Systems, 2008

482 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/de9b8587db48b44a142c8c9aa3b2d5133b967a74

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems (2015, background): “Overshadow [19], [42], CHAOS [18], InkTag [27], SP3 [49] and AppShield [20], use a hypervisor to isolate application memory and CPU state from the operating system.”
Efficient TCB Reduction and Attestation (2009, background): “Other designs (e.g., vTPM [4], Overshadow [7]) include a commercial VMM in their TCB, thereby ruling out the possibility of formal verification with known techniques.”
Towards Scaling Blockchain Systems via Sharding (2018, methodology): “ur implementations, but our design can work with any other TEE instantiations, for example hardware-based TEEs such as TrustZone [8], Sanctum [18], TPMs [5], or software-based TEEs such as Overshadow [16]. Threatmodel.The attacker has full control of the Byzantine nodes. It can read and write to the”
Shielding Applications from an Untrusted Cloud with Haven (2014, background): “Enclaves are created by an ECREATE instruction, which initialises a con-trol structure in protected memory.”
High-Resolution Side Channels for Untrusted Operating Systems (2017, methodology): “We assume that at least some parts of the application binaries are public, either because they belong to unmodified legacy applications [9,14,27,44] or because they are a part of a public application platform [39].”
VC3: Trustworthy Data Analytics in the Cloud Using SGX (2015, background): “Some of these properties could also be achieved using trusted hypervisors [17], [28], [36], [38], [58], but trusted”
Preventing Page Faults from Telling Your Secrets (2016, methodology): “As a recourse, we conduct all our experiments on P OD A RCH [44]; a system similar to previous hypervisor solutions [18] and conceptually similar to SGX.”
M2R: Enabling Stronger Privacy in MapReduce Computation (2015, methodology): “Previous works have successfully demonstrated how to securely execute a unit of user-deﬁned computation on an untrusted cloud node, us-ing support from hardware primitives available in commodity CPUs [8,14,38,39,49] .”
This paper is included in the Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’16). (unknown): “Subsequent work, including Overshadow [13], SP 3 [64], InkTag [27] and Virtual Ghost [16], has focused on reducing the size of the TCB by directly protecting application memory from unauthorized OS accesses.”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (unknown): “Systems like Overshadow [29], InkTag [40] and Sego [46] use a trusted hypervisor to protect trusted applications from an untrusted operating system, and InkTag/Sego also allow a trusted application to verify untrusted operating system services (e.g., a ﬁle system) with help from the hypervisor.”
NOVA: a microhypervisor-based secure virtualization architecture (2010, background): “Overshadow [7] protects the confidentiality and integrity of guest applications in the presence of a compromised guest kernel by presenting the kernel with an encrypted view on application data.”
TrustVisor: Efficient TCB Reduction and Attestation (2010, methodology): “We have implemented TrustVisor to protect security-sensitive code blocks while imposing less than 7% overhead on the legacy OS and its applications in the common case.”