{"id":517,"date":"2019-02-27T16:20:25","date_gmt":"2019-02-27T15:20:25","guid":{"rendered":"https:\/\/www.corporesano.no\/?page_id=517"},"modified":"2019-04-08T09:54:44","modified_gmt":"2019-04-08T07:54:44","slug":"corpore-sano-workshop-2019","status":"publish","type":"page","link":"https:\/\/site.uit.no\/corporesano\/events\/corpore-sano-workshop-2019\/","title":{"rendered":"Corpore Sano Workshop 2019"},"content":{"rendered":"

Corpore Sano Centre arranges an international by-invitation-only expert workshop focusing on next-generation industrial software challenges. This workshop will be arranged at Scandic Ishavshotell<\/a>, 09.00 – 17.00 April 9, 2019 followed by workshop dinner at R\u00e5 sushi restaurant<\/a> at 19.00.<\/p>\n

Program<\/strong> for the workshop:<\/p>\n

09.00 – 09.30<\/strong> Professor Dag Johansen<\/strong><\/a>, UiT<\/h5>\n

Title: “Corpor\u014d Sano, Towards Next-generation Enterprise Systems”<\/em><\/strong><\/p>\n

Abstract. This talk will provide the context for this workshop outlining on-going collaborative efforts in creating an inter-disciplinary R&D cluster of academics, industry and public sector stake holders. Our main problem is to research and develop robust and efficient technologies so that digitalization can be a facilitator for sustainable organizational development, growth, internationalization and business.\u00a0 Our use-case is primarily rooted in the financial sector but has wide applicability for almost any Internet focused domain.<\/p>\n

09.30 – 10.15<\/strong> Professor Robbert van Renesse<\/strong><\/a>, Cornell University<\/h5>\n

Title: “X-Containers: Breaking Down Barriers to Improve\u00a0Performance and Isolation of Cloud-Native\u00a0Containers<\/em><\/strong>”<\/p>\n

Abstract. Cloud-native\u201d container platforms, such as Kubernetes, have\u00a0become an integral part of production cloud environments.\u00a0One of the principles in designing cloud-native applications\u00a0is called Single Concern Principle, which suggests that\u00a0each container should handle a single responsibility well. \u00a0In this talk, we propose X-Containers as a new security\u00a0paradigm for isolating single-concerned cloud-native containers.\u00a0Each container is run with a Library OS (LibOS) that supports multi-processing for concurrency and compatibility.\u00a0A minimal exokernel ensures strong isolation with small kernel attack surface. We show an implementation\u00a0of the X-Containers architecture that leverages Xen paravirtualization\u00a0(PV) to turn Linux kernel into a LibOS. Doing\u00a0so results in a highly efficient LibOS platform that does not require hardware-assisted virtualization, improves intercontainer\u00a0isolation, and supports binary compatibility and multi-processing. By eliminating some security barriers such\u00a0as seccomp and Meltdown patch, X-Containers have up to 27% higher raw system call throughput compared to Docker\u00a0containers, while also achieving competitive or superior performance\u00a0on various benchmarks compared to recent container\u00a0platforms such as Google\u2019s gVisor and Intel\u2019s Clear\u00a0Containers.<\/p>\n

10.15 – 10.45 Break<\/strong><\/h5>\n
10.45 – 11.15<\/strong> PhD student Anders Gjerdrum<\/strong><\/a>, UiT<\/h5>\n

Title: \u201cBoronBase: A mutually distrusting clique-partitioned database implemented in Intel SGX<\/em>“<\/strong><\/p>\n

Abstract. Current state of the art secure data storage and processing systems assume execution on a trusted underlying platform. Compromised software, hardware, or malicious administrators may invalidate this premise, and leave unmitigated applications exposed to attacks.<\/p>\n

Hardware based Trusted Execution Environments (TEEs) , like Intel SGX and ARM Trustzone enable new execution models for running software securely in untrusted environments. From this, new trusted storage and processing systems can safeguard sensitive data while executing in an untrusted environment. Examples of users of such systems include: medical researchers, law enforcement, financial analysts, and corporate RnD, all of which have strict privacy requirements regarding curation of data.<\/p>\n

We define such cohorts of users with joint access to a shared data repository as a “clique”. A clique consists of 10s to 100s of users requiring authenticated, verifiable and attested access to a shared data repository. Moreover, cliques are considered mutually distrusting and require shielding from other cliques and instances must therefore be hosted in separate hardware isolated contexts.<\/p>\n

Limitations in the current generation of SGX reduce amount of memory available for trusted execution and datastore instances must therefore maintain a small memory footprint in order to allow cost efficient colocalization.<\/p>\n

This talk presents BoronBase, a hardware isolated per-clique micro database engine allowing partitioned data stores for cohosting mutually distrusted contexts. In BoronBase, data is stored and processed in entirely separate hardware contexts, preventing information leakage and cross tainting between cliques. In addition to shielding data from untrusted underlying infrastructure, BoronBase reduces the risk of data leaks caused by privilege escalation, buffer overflows and SQL injection attacks by jointly attesting the correctness of both server and client. Only pre-approved data queries and data requestors may execute in a BoronBase instance, where clients use is authenticated by also executing in trusted hardware.<\/p>\n

11.15 – 12.00<\/strong> Professor Hein Meling<\/strong><\/a>, University of Stavanger<\/h5>\n

Title: “The Vision of a Global Academic Database of Degree Certificates<\/em><\/strong>“.<\/p>\n

Abstract. We envision a global academic database of degree certificates issued by universities and other entities whose users are identifiable through biometrics. The goal is to eliminate the existence of fraudulent documents, while at the same time guaranteeing the long-term availability of documents for users.<\/p>\n

In this context, we are working on addressing three key challenges:<\/p>\n