Interop Tokyo 2014 SDI (Software Defined Infrustructure) ShowCase Seminoar Presentation. The presentation covers Neutron API models (L2/L3 and Advanced Network services), Neutron Icehouse Update and Juno topics.
レッドハット 朝活セミナー(1/15, 2/18)の下記セッションでの発表予定資料です。
「Red Hat Enterprise Linux OpenStack Platform環境でのDocker活用テクニック」
https://www.redhat.com/ja/about/events/red-hat-asakatsu-seminar-2016
Interop Tokyo 2014 SDI (Software Defined Infrustructure) ShowCase Seminoar Presentation. The presentation covers Neutron API models (L2/L3 and Advanced Network services), Neutron Icehouse Update and Juno topics.
レッドハット 朝活セミナー(1/15, 2/18)の下記セッションでの発表予定資料です。
「Red Hat Enterprise Linux OpenStack Platform環境でのDocker活用テクニック」
https://www.redhat.com/ja/about/events/red-hat-asakatsu-seminar-2016
ACSAC2020 "Return-Oriented IoT" by Kuniyasu SuzakiKuniyasu Suzaki
?
The document discusses a framework called reboot-oriented IoT (RO-IoT) designed to enhance security and life cycle management for disposable IoT devices through three key mechanisms: occasional network reboots, periodic memory forensics, and PKI-linked life cycle management. By utilizing Trusted Execution Environment (TEE), the proposed solutions aim to prevent devices from becoming unmanaged cyber debris and recover from unknown attacks effectively. The implementation details, performance evaluations, and future applications for RO-IoT are also presented, particularly in the context of smart city technologies.
Hardware-assisted Isolated Execution Environment to run trusted OS and applic...Kuniyasu Suzaki
?
This document discusses hardware-assisted isolated execution environments (HIEE) and trusted execution environments (TEE) on RISC-V processors. It describes how TEEs are implemented using privileges worlds on ARM TrustZone and Intel SGX. For RISC-V, it summarizes proposals for TEEs including Sanctum, MultiZone, and using seL4 microkernel to implement OP-TEE. It also briefly discusses TEE implementations on FPGAs, GPUs, virtualization, and the IETF's TEE provisioning protocol.
The document discusses Trusted Execution Environments (TEEs) and running the Open Portable Trusted Execution Environment (OP-TEE) trusted operating system on RISC-V. It provides an overview of TEEs, describes OP-TEE and the requirements to implement it on RISC-V, including developing a boot sequence, kernel driver, and libraries. The document also compares TEE implementations on ARM TrustZone and Intel SGX and covers memory mapping when running OP-TEE on ARM-based boards.
BMC: Bare Metal Container @Open Source Summit Japan 2017Kuniyasu Suzaki
?
The document introduces Bare Metal Containers (BMC), which allow applications running in containers to customize the kernel and select the machine architecture in order to optimize performance and power consumption. BMC measures power usage for each application running on different hardware to provide incentives for developing low power applications. It discusses the current implementation of the BMC manager and evaluations of the boot performance overhead on various machine types.
The document discusses Bare-metal Containers (BMC), a system allowing the direct execution of container images on remote machines with customizable kernels, addressing limitations of standard container technologies like Docker. It highlights performance issues, power consumption measurements, and a detailed implementation of BMC, including network bootloader processes. The conclusion states that BMC can provide substantial performance improvements for applications by using appropriate kernel settings tailored for their requirements.
Kernel Memory Protection by an Insertable Hypervisor which has VM Introspec...Kuniyasu Suzaki
?
The document presents 'DriverGuard', an insertable hypervisor designed to enhance the security of device drivers by utilizing VM introspection and stealth breakpoints. It addresses vulnerabilities in device drivers that can be exploited through various attack vectors without disrupting system operations, aimed particularly at critical infrastructure systems. The implementation and performance evaluation indicate that DriverGuard effectively protects sensitive regions and maintains acceptable overhead for sensitive data accesses.
This document describes a protocol test generator that uses nested virtual machines and rollback mechanisms to perform exhaustive fuzz testing of protocol implementations. It proposes using a virtual test protocol to encapsulate test packets and control the target virtual machine. Special packets allow taking snapshots of the target VM state and rolling back to previous snapshots to repeatedly test protocol states with different fuzzed packets. The current prototype implements this approach with KVM and QEMU virtual machines to find bugs in TLS/SSL protocol implementations through fuzz testing of the handshake process.
This document discusses a proposed technique for implementing rollback in secure communication protocols like TLS/SSL using nested virtual machines and proxies to address vulnerabilities. It outlines the challenges of managing protocol states and maintaining secure connections during the rollback process while offering an approach that simplifies implementation through existing technologies. The proposed solution enables parallel testing by transferring snapshot images to other machines for fuzzing tests.
Security on cloud storage and IaaS (NSC: Taiwan - JST: Japan workshop)Kuniyasu Suzaki
?
The document discusses security issues with cloud storage and proposes a solution called Virtual Jail Storage System (VJSS). VJSS aims to prevent information leaks from servers and clients by encrypting and splitting data across multiple providers. It also seeks to address concerns about information erasure and loss through error correction and an append-only file system.
Protect Your IoT Data with UbiBot's Private Platform.pptxユビボット 株式会社
?
Our on-premise IoT platform offers a secure and scalable solution for businesses, with features such as real-time monitoring, customizable alerts and open API support, and can be deployed on your own servers to ensure complete data privacy and control.
1. USENIX NDSI 2017報告
&
Efficient Memory Disaggregation with
Infiniswap (University of Michigan)
須崎有康
独立行政法人 産業技術総合研究所
第2回 システム系輪講会
2. NSDI2017概要
? 14th USENIX Symposium on Networked Systems Design and
Implementation
? https://www.usenix.org/conference/nsdi17
? MARCH 27–29, 2017, BOSTON, MA
? 投稿数254本、採択46本、シングルセッション、キーノートなし。
? 主催者から発表された今年のNSDI論文で使われたキーワード
? Security、Data Center、Distributed Systems、Big Data
? Best Paper Award
? mOS: A Reusable Network stack for Flow Monitoring Middleboxes
(KAIST)
? Community Award
? Transparently Compress Hundreds of Petabytes of Image Files for a File-
Storage Service (Stanford)
18. power of two random choices
? decentralized slab placements and evictionsの肝
? Michael Mitzenmacher, The Power of Two Choices in Randomized
Load Balancing, Ph.D Thesis, 2001.
? https://pdfs.semanticscholar.org/3885/812a092ff0aad3d45c0464660075e98d0231.pdf
? Michael Mitzenmacher, Andrea Richa, Ramesh Sitaraman,The Power
of Two Random Choices: A Survey of Techniques and Results, 1996.
? http://www.ic.unicamp.br/~celio/peer2peer/math/mitzenmacher-power-of-two.pdf
? Michael Mitzenmacher, The Power of Two Choices in Randomized
Load Balancing, IEEE Trans. Parallel and Distributed Systems, 2001.
? https://www.eecs.harvard.edu/~michaelm/postscripts/tpds2001.pdf
28. The Design, Implementation, and Deployment of a System to Transparently
Compress Hundreds of Petabytes of Image Files for a File-Storage Service (Dropbox,
Stanford University)
? Community Award Paper。JPEGファイルを保存するのにHuffman Codeから
parallelized arithmetic codeでスキャンし直して保存するファイルシステムの
Leptonの発表。圧縮率もCPU性能もよい。Lepton は2017年2月にDropBoxで
使われるようになっており、ソースコードも公開されている。
? PackJPG, MozJPG, JPEGreenなど類似に研究はあるが、JPEGの特徴を取り直
すためにHuffman Codeから別の圧縮方法でファイルシステムが対応するのは、
既存のフォーマットを残しつつシステム側で対応する新たな研究方向と思われ
る。
? また、Leptonの実装ではセキュリティを確保するのにLinuxのSECCOMを使っ
ている。また、C++のthreadで書かれているが、Deterministicを確保している
など、セキュリチィや再現性にまで言及しており、研究の質の高さを示してい
る。
30. One Key to Sign Them All Considered
Vulnerable: Evaluation of DNSSEC in the
Internet (Fraunhofer)
? 現在使われている210万個のDNSSECの鍵の脆弱性調査の発表。
190万個がRSA keyであり、このうち66%が1024bit以下。また、
共通のモジュラスや素数も見つかっている。
? モジュラスが共通だとCommon Modulus Attackが可能となる。
? この発表がインターネット全体を調査した唯一のものであった。
他の一流会議では2,3本あるのに対して、ネットワークが主眼な
会議にしては少ない。
31. Enhancing Security and Privacy of Tor's
Ecosystem by Using Trusted Execution
Environments (KAIST)
? Torではリレーノードが改ざんされてプライバシーが守れなく
なる脆弱性がある。Intel SGXを使い、TEE: Trusted Execution
Environmentによる安全なリレーノード検出し、それらのみを
使うSGX-Torの提案。Remote Attestationで検証し、承認され
たRelayのみを使う。SGX-Tor の実装ではEnclave中にSSL
Library(OpenSSL), zlib, libevnetが含まれる。
? 性能劣化は11.9%。
? SGX-Torのソースコード
? https://github.com/KAIST-INA/SGX-Tor