Microkernel OSes separate OS functionalities, including file systems and device drivers, into different user-level services, which mitigates the problem of lacking isolation in monolithic OSes. Nevertheless, from the perspective of applications, compromised services may still threaten applications’ security. Specifically, attackers can utilize vulnerabilities in file systems and disk drivers to leak or manipulate applications’ file content. The key problem is that de-privileging OS services from the kernel level to the user level does not mean the reduction of applications’ trusted computing base (TCB), and applications still need to trust all the required system services. This paper shows a case for providing the file service to applications with minimum TCB on microkernel OSes. Observing that file services actually do not need to access concrete file content, we propose a mechanism named Mirage, which deprives their privilege of accessing file content while preserving their management capability. Mirage efficiently protects the confidentiality and integrity of application files from untrusted services. The evaluation demonstrates that Mirage outperforms an encryption-based mechanism by up to 128% for IO-intensive workloads.

Nowadays, application migration becomes more and more attractive. For example, it can make computation closer to data sources or make service closer to end-users, which may significantly decrease latency in edge computing. Yet, migrating applications among servers that are controlled by different platform owners raises security issues. We leverage hardware-secured trusted execution environment (TEE, aka., enclave) technologies, such as Intel SGX, AMD SEV, and ARM TrustZone, for protecting critical computations on untrusted servers. However, these hardware TEEs propose non-uniform programming abstractions and are based on heterogeneous architectures, which not only forces programmers to develop secure applications targeting some specific abstraction but also hinders the migration of protected applications. Therefore, we propose UniTEE which gives a unified enclave programming abstraction across the above three hardware TEEs by using a microkernel-based design and enables the secure enclave migration by integrating heterogeneous migration techniques. We have implemented the prototype on real machines. The evaluation results show the migration support incurs nearly-zero runtime overhead and the migration procedure is also efficient.