Secure Tera-scale Data Crunching with a Small TCB Bruno Vavala Nuno Neves Peter Steenkiste UL / CMU UL CMU 47th IEEE/IFIP International Conference on Dependable Systems and Networks (DSN’17)
Goal delivering security guarantees for delivering security guarantees for generic and large-scale data large-scale data processing on untrusted hosts with a small TCB processing on untrusted hosts 2
delivering security guarantees for large-scale data processing trusted on untrusted hosts with a small TCB HW based data integrity 3
1 TB delivering security guarantees for large-scale data processing on untrusted hosts with a small TCB 4
small code delivering security guarantees for small large-scale data processing interface on untrusted hosts with a small TCB No HW devices 5
Some use cases public cloud service provider 6
Some use cases public cloud service provider computational genomics 0.3TB per genome 7
…more generally…
Model trusted hardware module P S V 9
Model P 2. outsource large state 1. provide state authentication data S V 10
Model 3. send request P 2. outsource large state 1. provide state authentication data S V 11
Model 3. send request 4. execute command P 2. outsource large state 1. provide state authentication data S V 12
Model 3. send request 4. execute command P 2. outsource 5. receive large state authenticated reply 1. provide state authentication data S V 13
Outline • Goal • Previous Work • Our solution: key ideas and overview • Evaluation
Outline • Goal • Previous Work • Our solution: key ideas and overview • Evalution
Haven (OSDI’14) service — designed for Intel SGX — large TCB (due to libOS) libOS — 10s of new interface calls + works with enclave unmodified applications interface picoprocess VHD host OS 16
VC 3 (IEEE S&P’15) map & reduce — designed for Intel SGX functions — specific for Hadoop job execution + small TCB protocol + data confidentiality enclave + can run unmodified narrow interface Hadoop applications process host OS 17
A Niche in the State of the Art Trusted App small Large Interface Computing TCB State calls Specific arch. Haven No Yes tens No SGX (OSDI’14) Yes VC3 Yes R,W Yes SGX MapReduce (S&P’15) workloads XMHF- none Yes No No TPM / TXT TrustVisor (but Minibox has tens) (S&P’13,’10) Yes Yes zero! No TV&SGX LaSt GT 18
Outline • Goal • Previous Work • Our solution: key ideas and overview • Evalution
untrusted env. trusted env. Scenario: two execution environments 20
app’s execution flow untrusted env. trusted env. the service code is running 21
app’s execution flow untrusted env. access data in block b i is b i in memory? trusted env. the service code accesses data in memory 22
app’s execution flow untrusted env. access data in block b i is b i in memory? yes keep going trusted env. when data is available, there are no interruptions 23
app’s execution flow untrusted env. access data in block b i handle page fault is b i in memory? no load data yes keep going trusted env. otherwise, the service is interrupted and data memory pages are loaded 24
app’s execution flow untrusted env. access data in block b i handle page fault is b i in memory? no load data yes keep going validate data trusted env. data is validated inside trusted environment, independently from service execution 25
app’s execution flow untrusted env. access data in resume block b i handle page fault is b i in memory? no load data yes keep going validate data trusted env. service is resumed and only if data is valid, service can make progress 26
…in practice…
Architecture untrusted Trusted address Untrusted address space space other state service SMM untrusted services handler code (State map manager) trusted OS Supervisor SGX/TPM Hardware 28
Architecture untrusted Trusted address Untrusted address space space other state service SMM untrusted services handler code (State map manager) on TrustVisor, Supervisor is trusted on SGX, Supervisor is untrusted untrusted OS Supervisor SGX/TPM Hardware 29
LaSt GT in 5 steps 4 •Offline data protection at the source •State registration •Data processing •Lazy loading from memory & disk •Execution verification
•Offline data protection at the source 1 •State registration •Data processing •Lazy loading from memory & disk •Verification
Data protection Hierarchical - Incremental as data is created 0 1 0 0 0 1 1 1 1 0 1 0 0 0 0 1 0 0 0 1 1 1 1 0 1 0 0 0 Made for: bytes/block 2 10 2 40 2 15 - Incremental validation Tree size (bytes) 2 20 2 25 2 30 as data is loaded 2 30 - Fast verification 2 20 - Single hash tree is 2 10 unsuitable 2 20 2 25 2 30 2 35 2 40 State size (bytes) 32
State Hierarchy root state root directory directory master chunks masterchunk chunks chunk chunk blocks files 33
State Hierarchy - components are state root loaded separately - unneeded components directory not loaded in memory - state root (1 hash) masterchunk allows state validation masterchunk chunk chunk chunk chunk 34
•Offline data protection at the source 2 •State registration •Data processing •Lazy loading from memory & disk •Verification
Trusted address space Untrusted address space state service SMM handler code (State map manager) When the trusted execution environment is created, only the code is available inside OS Supervisor 36
Trusted address space Untrusted address space state service SMM handler code (State map manager) grab root from disk OS Supervisor 37
Trusted address space Untrusted address space state service SMM handler code (State map manager) grab root - registration is from disk the first register state execution - state handler installs root - root is trusted OS Supervisor 38
Trusted address space Untrusted address space state service state SMM handler code root (State map manager) - state root is available before service code runs OS Supervisor 39
•Offline data protection at the source 3 •State registration •Data processing •Lazy loading from memory & disk •Verification
Trusted address space Untrusted address space state service state data SMM handler code root pages available pages NOT available - service code has view of entire state - state not readily available: inefficient loading it upfront OS Supervisor 41
Trusted address space Untrusted address space state service state data SMM handler code root page hit on access - Service code execution begins - Service accesses data in memory - Data retrieval is fast if data is already available OS Supervisor 42
Trusted address space Untrusted address space state service state data SMM handler code root page miss on access - Service code may access data on missing pages OS Supervisor 43
Trusted address space Untrusted address space state service state data SMM handler code root page - A page fault is triggered - Execution is interrupted, fault! seamlessly waiting to continue OS Supervisor 44
4 •Offline data protection at the source •State registration •Data processing •Lazy loading from memory & disk •Verification
Trusted address space Untrusted address space state service state data SMM handler code root page fault! OS Supervisor 46
Trusted address space Untrusted address space state service state data SMM handler code root page fault! grab state component - Let SMM handle missing data from disk - SMM loads data from disk page address OS Supervisor 47
Trusted address space Untrusted address space state service state data SMM data handler code root page fault! - in TrustVisor, validate in place - in SGX, copy, validate, copy validate data OS Supervisor 48
Trusted address space Untrusted address space state service state data SMM data handler code root page fault! - If Supervisor is trusted, invalid data => no resume (e.g.: TrustVisor) data is valid - If Supervisor is untrusted invalid data => no accept, so no access (e.g.: SGX) OS Supervisor 49
Trusted address space Untrusted address space state service state data SMM data handler code root page hit on access fault solved, data accessible on resume, continue… resume OS Supervisor 50
- HW-based attestation of code identity, including input request, state root, output reply, nonce - Client checks validity of attestation •Offline data protection at the source •Execution verification 5 and intended identities/hashes •State registration •Data processing •Lazy loading from memory & disk
Outline • Goal • Previous Work • Our solution: key ideas and overview • Implemention(s) • Evaluation
Recommend
More recommend
