Paper Title: Shielding Applications from an Untrusted Cloud with Haven

Problem : How to execute code (unmodified legacy binaries) on a server when

  • Processor can be trusted after attestation
  • But software cannot be trusted
  • With privacy and integrity
  • Attack Model:
    • Side-channel attacks are out of scope
    • Denial of service is out of scope
  • A good summary of the attack model: running programs on remote servers as if they are run on users’ own privates machines. e.g. program errors are still possible and Haven does not protect against that

Users of the system:

  • Cloud users who care about what AEGIS provides
    • Without having to understand the underlying security architecture
    • Willing to pay some cost (e.g. performance) for that goal

Audience of the paper:

  • Cloud providers
  • Architects
  • System software developers

Solution (and uniqueness):

  • Create an enclave and all code executed within enclave
    • Enclave is a protected (privacy and integrity) application address space
      • Hides application’s data from other applications
      • Attack Model (under SGX): trust the OS for exceptions and system calls
        • e.g. page table management
        • thread management
        • The “interface” between application and OS is assumed to be trusted
      • SGX uses similar methods as AEGIS to preserve confidentiality and integrity (same techniques, different parameters)
    • Haven goes one step further than SGX and removes “trusting the OS” from the attack model
  • LibOS: Combine OS and application in a package (Shift almost all of OS functionality to userspace library)
    • Haven contributions (additions) to SGX:
      • Still some interface to OS needed, but the interface is minimized
      • Verify all calls up/down the interface
      • LibOS is enhanced with encryption to protect private data from OS
  • Attestation process:
    • Creating enclave generates a key, all information and order used to create a unique signature for the enclave
    • Signature (unique to the processor) is verified with a certified authority to determine the authenticity of the signature
    • Communication with trusted certification server needs to be done by the user outside of cloud environment. If everything is done by the application running on the untrusted cloud, the attestation process can be faked.
  • Lots of work on isolating system from code, not much other way

Evaluation:

  • Did not evaluate security, but they built on SGX which is formally verified by Intel (very different from AEGIS which did not evaluate security at all)
  • Shield module was not validated, but is simple code
  • They evaluated overhead of Haven, but not SGX, but they didn’t have access to cycle-accurate simulator
    • For example, to estimate encryption overhead, they reduced DRAM clock frequency (which decreases bandwidth), but SGX encryption mostly increases the latency.