Eternal Sunshine of the Spotless Machine: Protecting Privacy with Ephemeral Channels

Authors:

Alan M. Dunn, Michael Z. Lee, Suman Jana, Sangman Kim, Mark Silberstein, Yuanzhong Xu, Vitaly Shmatikov, and Emmett Witchel, The University of Texas at Austin

Abstract:

Modern systems keep long memories. As we show in this paper, an adversary who gains access to a Linux system, even one that implements secure deallocation, can recover the contents of applications’ windows, audio buffers, and data remaining in device drivers—long after the applications have terminated.
We design and implement Lacuna, a system that allows users to run programs in “private sessions.” After the session is over, all memories of its execution are erased. The key abstraction in Lacuna is an ephemeral channel, which allows the protected program to talk to peripheral devices while making it possible to delete the memories of this communication from the host. Lacuna can run unmodified applications that use graphics, sound, USB input devices, and the network, with only 20 percentage points of additional CPU utilization.

Alan M. Dunn, University of Texas at Austin

Michael Z. Lee, University of Texas at Austin

Suman Jana, University of Texas at Austin

Sangman Kim, University of Texas at Austin

Mark Silberstein, University of Texas at Austin

Yuanzhong Xu, University of Texas at Austin

Vitaly Shmatikov, University of Texas at Austin

Emmett Witchel, University of Texas at Austin

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

Dunn PDF

View the slides