Fabian Schwarz

Fabian Schwarz

Dr.-Ing., Cybersecurity researcher with focus on TEE-based system and network security architectures

Portfolio

00SEVen: Remote Inspection of TEE VMs using In-VM Agents

Published:



While the strong hardware-based isolation of TEE VMs (TVMs) protects sensitive client data against a compromised cloud platform, it also renders existing VM introspection (VMI) capabilities unfeasible. Therefore, customers lose the capability to securely monitor their TVMs for in-VM attacks or perform a post-mortem analysis. Out-of-VM accesses are blocked while in-VM agents are not isolated from attackers that have compromised the TVM. 00SEVen overcomes these challenges by enabling secure remote VMI for AMD-based TVMs using new hardware-protected, attestable in-VM agents.

FeIDo: Recoverable FIDO2 Web Credentials using eIDs and TEEs

Published:



The flaws of password-based web authentication are still putting users at risk. The FIDO2 protocol is the current standard for mitigating the shortcomings of passwords by providing a secure authenticator as a strong second factor for 2FA. However, while web service support for FIDO2 is increasing, user adoption is lacking due to the need for specific user hardware and the missing support for secure account recovery on a device loss. Therefore, FeIDo proposes attribute-based web credentials based on electronic IDs (e.g., ePassports) and a remotely attestable, pseudonimizing proxy service protected by a trusted execution environment (TEE). FeIDo’s credentials are compatible with FIDO2, can be adopted by users with no extra costs, and allow for easy account recovery.

TrustedGateway: TEE-protected Routing and Firewalling for Network Gateways

Published:



The routing and firewall services of gateways form the core of a network’s functionality and security. However, their ever-increasing number of utility services and reliance on huge commodity OSes (e.g., Linux) has led to serious remote code execution vulnerabilities, enabling attackers to gain full control of gateways and their network policies. To restore trust in the security of consumer and enterprise networks, TrustedGateway protects the network traffic and core services of gateway routers against on-device attackers based on a trusted execution environment (TEE). That way, TrustedGateway guarantees the enforcement of trusted routing and firewall policies, even if the gateway OS has been compromised.

SENG: Application-grained Firewall Policies using TEE-based Traffic-to-App Attribution

Published:



Gateway firewalls isolate internal and external networks by mediating all network traffic and enforcing filter rules. To distinguish between benign and malicious sender applications, firewalls rely on heuristics (e.g., port information) or client-side identifiers (e.g., the process ID). However, these traffic attribution methods are unreliable and can be easily bypassed by attackers. Therefore, we propose SENG, a gateway-located service that cooperates with client-side runtimes to enable secure traffic-to-app attribution. The SENG runtimes protect client applications in trusted execution environments (TEEs) and share hardware-attested app identifiers with the SENG service to expose them to the firewall. That way, SENG enables gateway firewalls to securely attribute traffic to trusted applications and enforce app-grained firewall policies, even if the client systems have been compromised.