Android's underlying Linux kernel is rapidly becoming an attractive target for attackers. In 2014, the number of reported bugs in the kernel was 4 percent of the overall bugs discovered in Android. This number drastically increased to 9 and 44 percent in 2015 and 2016, respectively. These are not surprising as the kernel consists of millions of lines of code, which bloat the Trusted Computing Base (TCB) and enlarge the attack surface. For example, several recent bugs have been found in the Bluetooth [36] and WiFi [37, 172] subsystems of mobile devices. These bugs can be exploited by malicious parties over the network to mount remote attacks. An attacker uses these kernel bugs to get kernel privilege and gain complete control of the mobile device.

The common solution to this problem is to patch the kernel as soon as a new bug or a vulnerability is found in the kernel. However, this does not protect the system against zero-day vulnerabilities. In this dissertation, we present the security monitor, a small, trustworthy, and extensible software that provides different security services, with a small TCB. The security services within the security monitor enforce certain privacy and security guarantees for the system, e.g., enforcing certain privacy guarantees for the use of I/O devices. With the security monitor, a compromised operating system will not be able to undermine these guarantees. The security monitor is designed and built based on ARM TrustZone [24, 5, 26, 176] and virtualization hardware [70, 72], which are available in modern mobile and IoT devices. The hypervisor layer, supported by virtualization hardware, enables the security monitor to efficiently control accesses to certain part of the physical memory, e.g., registers of selected sensors, without making any modifications to the operating system. TrustZone, which is already being used by many security applications by vendors, provides a complementary use for the security monitor. It enables sealing of data to guarantee integrity, authenticity, and confidentiality.

One concern about the security monitor is performance. It is widely believed that running the main operating system on top of a hypervisor incurs significant performance overhead [93]. Through extensive experimentation and a redesign of the hypervisor, we provide evidence against this argument. We show that a commodity hypervisor's overhead is mainly due to its frequent interposing on the operating system activities, a design needed only in a multi-tenant virtualization setup. The hypervisor can be redesigned to minimize these interpositions and hence minimize its performance overhead on the main OS. We show that the performance of the operating system is very close to that of native execution.

We demonstrate three end-to-end systems that leverage the security monitor to design different security services: (i) trustworthy sensor notifications using low-level checks in the security monitor (Viola), (ii) trustworthy auditing of sensor activities by recording the sensor activities in the security monitor (Ditio), and (iii) secure formation of electronic contracts by designing secure primitives in the security monitor (Tabellion).

In response to the growing number of cyber security attacks worldwide, layers of security remedies and patches have been introduced in recent hardware and software systems. Although these solutions have thwarted some attacks, the reactive approach of adding yet another layer of indirection is not a panacea for all security problems. The dissertation aims to create secure systems throughout the computing stack, mainly using two approaches: (1) mitigating security hazards in legacy systems, and (2) designing systems that provide isolation at the lowest possible layer.

First, it highlights the security hazard of vulnerabilities in the graphics stack. To address this, two solutions are introduced. For desktops, it leverages GPU virtualization to provide web apps with a dedicated virtual graphics plane. For mobile devices, it designs a system to automatically repurpose the browser’s security checks to safeguard the mobile graphics interface.

Second, it presents a hardware design that is composed of statically-partitioned and physically-isolated trust domains, namely the Split-Trust hardware design. It introduces a few simple, formally-verified hardware components to enable a program to gain provably exclusive and simultaneous access to both computation and I/O on a temporary basis. To manage this hardware, it presents OctopOS, an OS composed of mutually distrustful subsystems.

Sutures, wires, and staples constitute the conventional standard of care for reconnecting tissues after surgical procedures to restore their structure and function. These methods generally have several limitations. For example, they are time-consuming and may cause further tissue damage and lead to infection. In addition, they may not provide immediate and adequate sealing to stop body fluid and air leakages. Using adhesive biomaterials is a suitable alternative for wound closure due to their characteristics, such as simple and painless application, and short implementation time. In this regard, various types of surgical materials have been used for sealing, reconnecting tissues, or attaching devices to the tissues. Based on the final application and the anatomical parts involved in the medical intervention, it is important to design these tissue adhesives with some specific characteristics such as: i) high biocompatibility, ii) easy and rapid application, iii) strong adhesion to the target tissue, iv) biomimetic mechanical properties, v) permeability to nutrients and gases, vi) supporting tissue regeneration, and vii) antimicrobial properties in the case of infected wounds. However, commercially available surgical adhesives have many drawbacks and generally only possess one of the properties mentioned above. In this project, we aimed to combine different types of highly biocompatible biopolymers (e.g. gelatin, elastin like polypeptides, and hyaluronic acid) with different nanomaterials to engineer novel bioadhesives with the combined properties mentioned above. These biopolymers were first chemically modified to form photocrosslinakble hydrogels through a short exposure to visible light in the presence of a highly biocompatible photoinitiator (Eosin Y). The engineered adhesives exhibited tunable physical properties and could be tailored for a variety of surgical and tissue engineering applications. As the first step of the project, a flexible and transparent gelatin-based adhesive was designed for corneal tissue sealing and repair. The mechanical properties of the engineered hydrogel adhesive were optimized to mimic the stiffness of the native cornea. In addition, the formulation of the adhesive was modified to obtain high adhesion to the cornea, while retaining appropriate biodegradability and high cytocompatibility in vitro. Our data showed that the engineered hydrogel adhesives had higher adhesive strength than commercially available adhesives used for cornea such as ReSure� (Ocular Therapeutix, Inc., USA), based on standard adhesion tests by the American Society for Testing and Materials (ASTM). In addition, ex vivo tests on explanted rabbit eyes demonstrated that the adhesives possessed high retention and were resistant to burst pressure. Furthermore, in vivo tests were conducted using a rabbit stromal cornea defect model to test the biocompatibility and retention of the biomaterial, as well as corneal regeneration after the application. In the second part of this proposal, we modified our engineered hydrogels to fabricate multifunctional adhesives through incorporation of different drugs and nanomaterials. In particular, we engineered antimicrobial adhesives by incorporating ZnO nanoparticles (NPs) or antimicrobial peptides (Tet213) to the structure of the biopolymer prior to photopolymerization. In addition, we showed that the incorporation of laponite (disc shaped silicate NPs) could lead to the formation of osteoinductive adhesives that can be used for a wide range of applications, such as bone and dental tissue engineering. These multifunctional adhesive hydrogels exhibited high biocompatibility, mechanical stability and tissue integration in different animal models such as subcutaneous implantation in rats, and a mouse calvarial defect model. Our engineered multifunctional adhesives with tunable physical and adhesive properties can be used as a platform for sealing and repair of various tissues such as bone, lung, skin, and arteries.

Social VR apps, which enable users to interact in virtual spaces, are increasingly popular. Unfortunately, a large number of harassment incidents have taken place in these apps. To mitigate this issue, VR platforms and apps ask victims to report the incidents to analyze the reports, and if needed, punish the harassers. However, existing reporting solutions are ad hoc and cannot provide strong guarantees for integrity and authenticity of reports. Also, reports cannot always identify the harassers. To address these problems, we introduce Visor, a system solution for providing trustworthy and effective reports for social VR. To enable trustworthy reports, Visor incorporates a secure recorder on VR headsets to capture tamper- proof and irrefutable snapshots of visual content shown on the headset’s display. To enable effective reports, Visor introduces mandatory recording, a novel paradigm, which, alongside a search engine in an auditing server, facilitates identifying the harasser in a report. Our security analysis and evaluation with a VR headset prototype show that Visor is secure and adds small performance overhead. Moreover, using a 12-hour 99-user social VR experiment with automated users, we demonstrate that the mandatory recording paradigm helps an auditor find a harasser with 4 minutes of manual effort, on average.

Mobile devices, such as smartphones and tablets, have a critical role in our everyday life. We use our mobile devices for various personal and professional tasks. Unfortunately, numerous bugs and vulnerabilities have been found in them. As a result, there are important concerns regarding the security and privacy of these devices. Compared to conventional personal computers, mobile devices have unique features such as a different processor family (e.g. ARM), different operating systems (e.g. Android), and a diverse set of I/O devices. These features raise unique challenges in securing them.

We pursued a comprehensive approach in three directions towards addressing the challenges of building secure mobile devices. In the first direction, we proposed Charm, a system solution to improve software analysis and bug/vulnerability discovery in mobile devices. In the second direction, we provided mitigations for existing bugs/vulnerabilities via implementing two security extensions, bowknots, which provide undo workaround for kernel bugs, and MegaMind, which provides an extensibility platform for security and privacy of voice assistants. Finally, we introduced a split-trust machine model, which uses physical isolation to prevent bugs from making security-critical applications vulnerable.

Symbolic execution is a widely used program analysis technique to systematically executedifferent program execution paths without requiring concrete inputs. Developed from sym- bolic execution, Selective Symbolic Execution (SSE) is a technique for creating the illusion of full system symbolic execution, while symbolically running only the code that is of interest to the analyst. SSE makes symbolic execution practical for large software like an operating system by alleviating the problem of path explosion.

In this thesis, we demonstrate the possibility of using SSE to tackle security challenges inoperating systems. Our first work is Mousse, which is a system for selective symbolic execu- tion of programs with untamed environments. Mousse facilitates testing operating system services that are highly coupled with their underlying environment by developing three novel solutions. Our second work is Macaron, which is the first framework that can automatically and reliably reproduce non-deterministic race condition bugs in the operating system kernel. We demonstrate the usefulness of Macaron by using it to reproduce bugs found (but not reproduced) by syzbot, the state-of-the-art continuous kernel fuzzing framework. We build Macaron using a novel Guided Selective Symbolic Execution (GSSE), static analysis, and a distance-based thread interleaving points scheduling algorithm.