clemmys
play

Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , - PowerPoint PPT Presentation

Nov 01, 2022 •349 likes •1.34k views

Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , Oleksii Oleksenko, Franz Gregor, Pramod Bhatotia, Christof Fetzer ACM SYSTOR 2019 FaaS Paradigm of Cloud Computing Function Runtime Guest OS Function Hypervisor Host OS FaaS

  1. Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , Oleksii Oleksenko, Franz Gregor, Pramod Bhatotia, Christof Fetzer ACM SYSTOR 2019

  2. FaaS Paradigm of Cloud Computing Function Runtime Guest OS Function Hypervisor Host OS

  3. FaaS Paradigm of Cloud Computing ● Less boilerplate work ☺ Function Runtime Easy autoscaling ☺ ● Guest OS Hypervisor Host OS

  4. How does FaaS work? Worker 1 Function A Gateway Controller Function B Worker 2 Function C

  5. How does FaaS work? Controller Worker 1 Function A Gateway Function B Worker 2 Function C

  6. How does FaaS work? Worker 1 Function A Gateway Controller Function B Worker 2 Function C

  7. How does FaaS work? Worker 1 itQX/e8= Function A Gateway Controller Function B Worker 2 Function C

  8. How does FaaS work? Worker 1 Secret Function A Gateway Controller Function B Worker 2 Function C

  9. How does FaaS work? Worker 1 A(Secret) Function A Gateway Controller Function B Worker 2 Function C Support for function chaining is an important requirement for serverless computing

  10. How does FaaS work? Worker 1 Function A Gateway Controller Function B B(A(Secret)) Worker 2 Function C Support for function chaining is an important requirement for serverless computing

  11. How does FaaS work? Worker 1 Function A Gateway Controller Function B Worker 2 Function C C(B(A(Secret))) Support for function chaining is an important requirement for serverless computing

  12. How does FaaS work? Worker 1 C(B(A(Secret))) Function A Gateway Controller Function B Worker 2 Function C

  13. How does FaaS work? Worker 1 IysMdOmldNYL Function A Gateway Controller Function B Worker 2 Function C

  14. Is Faas secure? ● Less boilerplate work ☺ ● Easy autoscaling ☺ Worker 1 Function A Gateway Controller Function B Worker 2 Function C

  15. Is Faas secure? ● Less boilerplate work ☺ ● Easy autoscaling ☺ ● Low-trust environment Worker 1 Function A Gateway Controller Function B Worker 2 Function C

  16. Why is FaaS insecure? Inspect Network Traffic Worker 1 Function A Gateway Controller Function B Worker 2 Function C

  17. Why is FaaS insecure? Inspect Network Traffic Worker 1 Function A Gateway Controller Function B Worker 2 Function C Inspect Process Memory

  18. State-of-the-Art: Computing on Untrusted Systems Multiparty Computations Homomorphic Encryption Function Runtime ● High performance overhead Guest OS Low flexibility ● Hypervisor Related Work: Host OS ● nGraph-HE [IACR 2019/350] PySyft ●

  19. State-of-the-Art: Computing on Untrusted Systems Intel SGX Function Runtime ● Acceptable overhead ☺ Guest OS Arbitrary workloads ☺ ● Hypervisor Related Work: Host OS ● S-FaaS [CoRR abs/1810.06080]

  20. What is Intel SGX? User Application (Untrusted Memory) Operating System

  21. What is Intel SGX? ● Adds enclave abstraction User Application (Untrusted Memory) Enclave Operating System/Hypervisor

  22. What is Intel SGX? ● Adds enclave abstraction User Application (Untrusted Memory) Encrypted in RAM only ○ Enclave Encrypted in RAM Unencrypted in CPU cache Operating System/Hypervisor

  23. What is Intel SGX? ● Adds enclave abstraction User Application (Untrusted Memory) Encrypted in RAM only ○ Enclave ○ Not accessible from outside Read, Write Read, Write Operating System/Hypervisor

  24. What is Intel SGX? ● Adds enclave abstraction User Application (Untrusted Memory) Encrypted in RAM only ○ Enclave ○ Not accessible from outside ○ Developer-specified entry points Call Exit Call Enter Operating System/Hypervisor

  25. What are the limitations of Intel SGX? ● High overheads for: User Application (Untrusted Memory) Secure memory paging ○ Enclave ○ Enclave startup with large heap 94MB of HW-encrypted memory available Operating System/Hypervisor

  26. Why do Intel SGX limitations matter? Function startup time as an optimization target: ● SAND, SOCK [ATC’18]

  27. Why do Intel SGX limitations matter? Function startup time as an optimization target: ● SAND, SOCK [ATC’18] Problem for SGXv1 enclaves

  28. Why do Intel SGX limitations matter? Function startup time as an optimization target: ● SAND, SOCK [ATC’18] Problem for SGXv1 enclaves ● Can be solved with SGXv2 Additional optimizations are worth investigating.

  29. Problem Statement How to execute a wide range of user functions in FaaS in a trustworthy and efficient manner?

  30. Outline ● Motivation Design ● ● Evaluation ● Summary

  31. What is Clemmys? Function A TLS Gateway Controller Function B Function C Based on Apache OpenWhisk SGX Enclave Native Application

  32. What is Clemmys? 1. Trustworthy environment for function execution Key Mgmt Service Function A TLS Gateway Controller Function B Function C Based on Apache OpenWhisk SGX Enclave Native Application

  33. What is Clemmys? 1. Trustworthy environment for function execution Key Mgmt Service Function A TLS Plaintext Metadata + Plaintext Metadata + Gateway Controller Function B + Encrypted Data + Encrypted Data Function C Based on Apache OpenWhisk 2. Message format for secure function chaining SGX Enclave Native Application

  34. What is Clemmys? 1. Trustworthy environment for function execution Key Mgmt Service Function A TLS Plaintext Metadata + Plaintext Metadata + Gateway Controller Function B + Encrypted Data + Encrypted Data Function C Based on Apache OpenWhisk 2. Message format for secure function chaining 3. Function startup time optimizations (SGXv2) SGX Enclave Native Application

  35. What is Clemmys? 1. Trustworthy environment for function execution 4. Key management and deployment scheme Key Mgmt Service Function A TLS Plaintext Metadata + Plaintext Metadata + Gateway Controller Function B + Encrypted Data + Encrypted Data Function C Based on Apache OpenWhisk 2. Message format for secure function chaining 3. Function startup time optimizations (SGXv2) SGX Enclave Native Application

  36. What is Clemmys? 1. Trustworthy environment for function execution 4. Key management and deployment scheme Key Mgmt Service Function A TLS Plaintext Metadata + Plaintext Metadata + Gateway Controller Function B + Encrypted Data + Encrypted Data Function C Based on Apache OpenWhisk 2. Message format for secure function chaining 3. Function startup time optimizations (SGXv2) SGX Enclave Native Application

  37. What is Clemmys? 1. Trustworthy environment for function execution 4. Key management and deployment scheme Key Mgmt Service Function A TLS Plaintext Metadata + Plaintext Metadata + Gateway Controller Function B + Encrypted Data + Encrypted Data Function C Based on Apache OpenWhisk 2. Message format for secure function chaining 3. Function startup time optimizations (SGXv2) SGX Enclave Native Application

  38. Components of Clemmys ● Internal encryption Function chain verification ● ● Function startup optimizations ● Function deployment and key management

  39. How does Clemmys secure communication? EPC paging → slow! Function A TLS TLS TLS Gateway Controller Function B Function C SGX Enclave Native Application

  40. How does Clemmys secure communication? Function A TLS ??? ??? Gateway Controller Function B Function C SGX Enclave Native Application

  41. How does Clemmys secure communication? Idea: separate controller metadata (plaintext) from function arguments (encrypted) Function A TLS ??? ??? Gateway Controller Function B Function C SGX Enclave Native Application

  42. How does Clemmys secure communication? Idea: separate controller metadata (plaintext) from function arguments (encrypted) Function A TLS Plaintext Metadata + Gateway Controller Function B + Encrypted Data Function C Plaintext Metadata + + Encrypted Data SGX Enclave Native Application

  43. Components of Clemmys ● Internal encryption Function chain verification ● ● Function startup optimizations ● Function deployment and key management

  44. Why should function chain order be enforced? ● Naive encryption does not preserve function order. Scale TLS Plaintext Metadata + Gateway Controller Detect Features + Encrypted Data Report & Log SGX Enclave Native Application

  45. Why should function chain order be enforced? ● Naive encryption does not preserve function order. Scale TLS Plaintext Metadata + Gateway Controller Detect Features + Encrypted Data Report & Log Plaintext Metadata + + Encrypted Data SGX Enclave Native Application

  46. Why should function chain order be enforced? ● Naive encryption does not preserve function order. Message format should preclude these attack vector. ● Scale TLS Plaintext Metadata + Gateway Controller Detect Features + Encrypted Data Report & Log Plaintext Metadata + + Encrypted Data SGX Enclave Native Application

  47. Why should function chain order be enforced? ● Naive encryption does not preserve function order. Message format should preclude these attack vector. ● See paper for technical details Scale TLS Plaintext Metadata + Gateway Controller Detect Features + Encrypted Data Report & Log Plaintext Metadata + + Encrypted Data SGX Enclave Native Application

Recommend

More recommend