sancus-tee / sancus-examples

Examples and test suite

sancus-examples

Elementary example programs to test your Sancus distribution.

Overview

The following programs showcase the security properties offered by a Sancus processor.

Security feature	Example program	Comments
Software module isolation	hello-world	Minimal working example to enable/disable a Sancus module.
Secure linking	sensor-reader	Caller/callee authentication between sensor and reader SMs.
Remote attestation	sensor-reader	Compute MAC over fresh challenge (nonce).
Secure communication	sensor-reader	Authenticated encryption with associated data primitive.
Confidential deployment	confidential-loading	SM text section is transparently encrypted at build time.
Secure interrupts	timer	Interruption and resumption of an application SM by untrusted ISR software.

Building upon the above primitives, compiler support has been implemented for the following additional features.

Compiler feature	Example program	Comments
Secure memory-mapped I/O	sensor-reader	Assembly driver SM with exclusive ownership over sensor device.
Secure interrupt handling	timer-protected	Secure, authenticated interrupt delivery to an intra-SM interrupt handler.
Dynamic loading	dynamic-loader	SM binary image is dynamically linked and loaded by untrusted support software at runtime.
Intra-SM multiplication	arithmetic	Dummy SMs performing secure (inlined) arithmetic operations.
Reactive programming	todo issue #20	Minimalist (non-contiki) program with SM_INPUT/OUTPUT?

Running the examples

First, make sure you have a working Sancus distribution. See the sancus-main repository for detailed installation instructions.

All example binaries can be ran in either the Sancus Verilog simulator, or on an external FPGA. To build and run the example in sancus-sim, proceed as follows:

$ make sim

Alternatively, to upload the example to an FPGA using sancus-loader:

$ make load

sancus-examples's Issues

Add example of dynamic loading and attestation

Add a minimalistic example of how to dynamically load and attest an SM at runtime, using the untrusted sancus-support host software (ELF loader).

CI: fileio hangs

times out in CI and locally

Cleanup Travis CI build script

We probably want to modify sancus-main for this purpose.

Also, the Travis CI build should be triggered for every commit to any depending sancus repo (i.e., when changing compiler/core).

Implement sensor SM as an MMIO module

The sensor module SM_s should read data directly from an MMIO peripheral device, as discussed in the paper. The peripheral should probably be simulated in sancus-sim (e.g., use an existing peripheral such as the time stamp counter).

Should be done after compiler support for MMIO SMs has been merged.

Simplify hello-world without confidential loading

As discussed with @fritzalder we should simplify hello-world and hello-library to be more minimal and without confidential loading (which is also not supported on Aion).

Current hello-world can be renamed to something like hello-conf or so

Fritz:

I'd vote for renaming hello-world to confidential-sm and rewrite hellow-world to be simpler and use sancus enable only

Minimal reactive programming example

Also, when merging this code, I think it'd make a lot of sense to have a minimalist (non-contiki) program with SM_INPUT/OUTPUT as part of the sancus-examples continuous integration to make sure everything keeps working?

Do you think such a mini example would be feasible?

https://github.com/sancus-tee/sancus-examples

yes it definitely makes sense, I'll keep this in mind!

Originally posted by @gianlu33 in sancus-tee/sancus-compiler#36 (comment)

Dynamically generate Actions build matrix

We now hard code the sancus-examples test directories:

      matrix:
        example: [hello-world, sensor-reader, arithmetic, fileio, timer, violation, sancus-step, dma, dynamic-loader]

This can better be auto-generated using an ls in a first stage that is passed with a needs.output construct

https://github.blog/changelog/2020-04-15-github-actions-new-workflow-features/

Add example of confidential loading

Complete minimal working example of how to confidentially load, run, and unload an SM.