DetCordon
Containment & evidence / teaser
Assume the guest is already lost.
01 / the boundary
Trust less code.
The guest can become the adversary. The machinery around it must stay smaller, duller and harder to misuse.
≈60k
security-critical user-space LOC
Firecracker + DetCordon runtime
Firecracker + DetCordon runtime
outside trust
Guest workload + guest kernel
payload · webshell · exploit chain · persistence attempts
Firecracker v1.16.1 · ~50k LOC
jailer → VMM → vCPU threads
KVM · seccomp · cgroups · namespaces · chroot · VirtIO net/block/vsock
DetCordon-owned runtime
tap · supervisor · extractor · sink · guard
bounded hostile input · evidence hashing/encryption · lifecycle teardown
platform TCB — explicit
Linux / KVM / hardware
still trusted for isolation; not hidden by the user-space LOC headline
Every optional device, protocol and privilege has to justify its existence.
LOC headline: published Firecracker ~50k figure + scoped DetCordon security path estimate. Kernel/platform trust remains explicit.
minimal surface / explicit platform trust02
02 / evidence survives the guest
The compromised guest does not get to name the truth.
Observe
DetectionOnly HTTP tap records bounded metadata; eBPF can add execution, write and connect telemetry.
Capture
Extractor sends candidate file bodies outward. The guest cannot query the sink for them later.
Recompute
Sink computes SHA-256 itself. A hostile sender cannot declare the identity of a sample.
Seal
Samples are age-encrypted to the analyst public key and stored by digest; unexpected sink writes are observed.
SHA-256content identity computed at receiver
agesink stores ciphertext; private key stays elsewhere
SSHSIGcanonical manifest verifies offline
mTLSproducer certificates bind to source identity
Tamper resistance is layered: recompute, encrypt, restrict, sign, verify.
one-way evidence / independent verification03
03 / evidence is not interpretation
Context can change.
Evidence must not.
Evidence / preserved
What the run produced
Redacted events, encrypted samples, timestamps, source identity, config digests, custody lineage, checksums and detached signature.
events.jsonlsamples/<sha256>manifest.jsonchecksums.txtbundle.sig
↓
Enrichment / derived
What helps the analyst decide
ASN/network context, reputation, YARA/AV, clustering, threat-intelligence matches, analyst notes and machine summaries.
replaceabletime-sensitivesource-attributedlinked by digestnever rewrites observation
Enrichment may be wrong and still be useful. It must never become the original.
derive downstream / preserve upstream04
04 / evidence reaches a human
Every handoff is another chance to verify.
01
Sandbox → sink
separate host · default-drop guest egress · distinct event/sample channels · CA-validated TLS on reliable paths
02
Sink → evidence bundle
sink-computed digests · age ciphertext · canonical manifest · custody · checksums · detached SSHSIG
03
Bundle → archive / analyst
offline verification · archive copy verified again · signer trust anchor comes through a separate channel
04
Analyst workstation
verify first · decrypt with private key never present on sink · enrich only after evidence identity is fixed
Contain the execution.
Separate the evidence.
Verify before belief.
Separate the evidence.
Verify before belief.
Basis: DetCordon architecture, security register, evidence-bundle contract and Firecracker plan. Firecracker v1.16.x docs; published ~50k LOC figure. Linux/KVM/hardware remain in platform TCB.
DetCordon / RAGBAZ05