Project: Sanctuary

The protection of sensitive data is of great importance on all of today’s computing devices, ranging from resource constraint embedded devices over mobile devices up to powerful cloud servers. Driven by megatrends such as the Internet of Things (IoT) or new applications (e.g., autonomous driving), new cloud computing services (e.g., Container-as-a-service) and also new data protection regulations (e.g., GDPR), the demand for security solutions across platforms and services is ever increasing. Meanwhile, the interplay between these systems is also increasing continuously.

For instance, in modern vehicles more than 100 electronic control units (ECUs) provide safety and comfort functionalities by connecting to each other – as well as to the cloud. The large number of independent systems leads to increasing hardware, development and maintenance costs due to their complex dependencies and interactions.

We at Sanctuary believe that security should enable, not prevent. We understand security as a core primitive to build sustainable next-generation business solutions. Sanctuary allows aggregating such multi-device systems onto shared platforms, e.g., by combining multiple autonomous driving services and the car infotainment software on a single device, thus, reducing hardware costs. Simultaneously, Sanctuary unifies the security properties of all devices and services, thus simplifying their development and maintenance. This further reduces costs and time to market.

In order to securely consolidate multiple systems, it is crucial that the underlying software architecture provides strong hardware-assisted isolation mechanisms and adheres to safety requirements dominant in many embedded industries. Sanctuary offers these capabilities, and additionally, can monitor a system’s health state to detect and report incidences, including both, attacks from malicious entities as well as faults due to errors. Combined with strongly protected cryptographic functionalities, using virtual HSM technology, Sanctuary allows secure operation in distributed scenarios. Sanctuary provides all these benefits on unmodified off-the-shelf hardware platforms.

Sanctuary is a spin-off project from our research group, lead by Ferdinand Brasser, Patrick Jauernig, and Emmanuel Stapf.

For more information, visit https://sanctuary.dev