Tical Framework Enables Trusted and Integrity-Protected Compilation of Applications in Untrusted Environments

Protecting applications in increasingly vulnerable environments, such as public clouds, demands robust security measures, and recent efforts focus on runtime confidentiality and integrity. However, a critical vulnerability lies in the compilation process itself, where maliciously injected code can compromise entire systems, a risk often overlooked. Robert Krahn, Nikson Kanti Paul, and Franz Gregor, all from Technische Universität Dresden, along with Do Le Quoc and Andrey Brito, address this challenge with Tical, a novel framework for trusted compilation. Tical safeguards the build pipeline, from source code to executable, by combining trusted execution environments with file system shielding and an immutable audit log, ensuring only trusted files and processes contribute to the final application, and demonstrably protecting against build-time attacks with acceptable performance overhead.

Secure File System Auditing with Intel SGX

This research introduces TICAL, a system designed to secure file system operations using Intel SGX. The team addresses a critical vulnerability, the reliance on a trustworthy operating system, by creating an isolated environment for critical file system tasks. TICAL achieves this by securely logging all file modifications within an SGX enclave, creating a tamper-proof audit trail based on Git version control. This allows for easy inspection and verification of changes, and detects unauthorized file modifications before they are accessed, preventing applications from operating on corrupted data. The system integrates seamlessly with standard libraries, requiring no application code changes.

Trusted Compilation Safeguards Build Pipelines From Source

Researchers developed Tical, a practical framework for securing build pipelines from source code to executable. Recognizing that compromised compilers or build processes can introduce malicious code, the team harnessed Intel SGX to create an isolated and protected compilation process, minimizing the Trusted Computing Base. Tical runs compilation tasks within SGX enclaves, cryptographically secured areas of memory, and implements a file system shielding layer within the SCONE runtime environment, extending its capabilities with integrity protection and detailed audit logging. This intercepts system calls, meticulously tracking all file modifications, establishing accountability, and creating an immutable audit log with a comprehensive version history. The system leverages SGX attestation features, verifying the identity of enclave processes and confirming that compiler executables remain unmodified. Benchmarks reveal low performance overhead, making it practical for continuous integration and continuous delivery (CI/CD) pipelines.

Secure Software Builds with Trusted Execution Environments

The research team presents Tical, a practical framework designed to protect the integrity and confidentiality of software compilation and build pipelines. This system addresses a critical security gap, safeguarding against malicious code injection during the build process itself. Tical leverages Trusted Execution Environments (TEEs), specifically Intel SGX, extending their capabilities with a shielded file system and an immutable audit log that meticulously tracks all changes. The core of Tical consists of build pipeline executables, such as compilers and build tools, running securely within SGX enclaves using the SCONE framework.

A Configuration and Attestation Service (CAS) maintains a comprehensive record of all content modifications, ensuring accountability. To provide transparent versioning and integrity protection, Tical integrates a local Git repository into the shielded file system, transforming all file manipulations into Git operations, creating a permanent, auditable history. The system also supports secure transfer of secrets from the CAS to the application via TLS following successful attestation.

Build Pipeline Integrity Via Trusted Execution

Tical represents a significant advancement in build pipeline security, addressing the often-overlooked vulnerability of compromised code introduced during compilation. Researchers developed a practical framework that safeguards the integrity and confidentiality of software builds, from initial source code to the final executable. The system leverages trusted execution environments, enhanced with file system shielding and an immutable audit log, to ensure that the compiler chain operates only on trusted files and intermediate outputs, providing a verifiable record of all file modifications. Evaluations demonstrate that Tical effectively protects build pipelines with acceptable performance overhead, offering both coarse- and fine-grained configuration options to balance security and efficiency. The framework is designed for transparency, integrating closely with standard libraries and requiring no source code modifications or recompilation.