Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , - - PowerPoint PPT Presentation

▶
clemmys
SMART_READER_LITE
LIVE PREVIEW

Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , - - PowerPoint PPT Presentation

Nov 01, 2022 349 likes •1.34k views

Clemmys Towards Secure Remote Execution in FaaS Bohdan Trach , Oleksii Oleksenko, Franz Gregor, Pramod Bhatotia, Christof Fetzer ACM SYSTOR 2019 FaaS Paradigm of Cloud Computing Function Runtime Guest OS Function Hypervisor Host OS FaaS

slide-1
SLIDE 1

Clemmys

Towards Secure Remote Execution in FaaS

Bohdan Trach, Oleksii Oleksenko, Franz Gregor, Pramod Bhatotia, Christof Fetzer

ACM SYSTOR 2019

slide-2
SLIDE 2

Guest OS

FaaS Paradigm of Cloud Computing

Function Runtime Host OS Hypervisor Function

slide-3
SLIDE 3

FaaS Paradigm of Cloud Computing

  • Less boilerplate work ☺
  • Easy autoscaling ☺

Guest OS Function Runtime Host OS Hypervisor

slide-4
SLIDE 4

Worker 1 Worker 2

How does FaaS work?

Function A Function B Function C Controller Gateway

slide-5
SLIDE 5

Worker 1 Worker 2

How does FaaS work?

Function A Function B Function C Controller Gateway

slide-6
SLIDE 6

Worker 1 Worker 2

How does FaaS work?

Function A Function B Function C Controller Gateway

slide-7
SLIDE 7

Worker 1 Worker 2

How does FaaS work?

Function A Function B Controller Gateway

itQX/e8=

Function C

slide-8
SLIDE 8

Worker 1 Worker 2

How does FaaS work?

Function A Function B Controller Gateway

Secret

Function C

slide-9
SLIDE 9

Worker 2 Worker 1

How does FaaS work?

Function A Function B Controller Gateway

A(Secret)

Function C Support for function chaining is an important requirement for serverless computing

slide-10
SLIDE 10

Worker 2 Worker 1

How does FaaS work?

Function A Function B Controller Gateway

B(A(Secret))

Function C Support for function chaining is an important requirement for serverless computing

slide-11
SLIDE 11

Worker 2 Worker 1

How does FaaS work?

Function A Function B Controller Gateway

C(B(A(Secret)))

Function C Support for function chaining is an important requirement for serverless computing

slide-12
SLIDE 12

Worker 2 Worker 1

How does FaaS work?

Function A Function B Controller Gateway

C(B(A(Secret)))

Function C

slide-13
SLIDE 13

Worker 2 Worker 1

How does FaaS work?

Function A Function B Controller Gateway

IysMdOmldNYL

Function C

slide-14
SLIDE 14

Worker 2 Worker 1

Is Faas secure?

Function A Function B Controller Gateway Function C

  • Less boilerplate work ☺
  • Easy autoscaling ☺
slide-15
SLIDE 15

Worker 2 Worker 1

Is Faas secure?

Function A Function B Controller Gateway Function C

  • Less boilerplate work ☺
  • Easy autoscaling ☺
  • Low-trust environment
slide-16
SLIDE 16

Worker 2 Worker 1

Why is FaaS insecure?

Function A Function B Controller Gateway Function C Inspect Network Traffic

slide-17
SLIDE 17

Worker 2 Worker 1

Why is FaaS insecure?

Function A Function B Controller Gateway Function C Inspect Network Traffic Inspect Process Memory

slide-18
SLIDE 18

State-of-the-Art: Computing on Untrusted Systems

  • High performance overhead
  • Low flexibility

Related Work:

  • nGraph-HE [IACR 2019/350]
  • PySyft

Guest OS Function Runtime Host OS Hypervisor Multiparty Computations Homomorphic Encryption

slide-19
SLIDE 19

State-of-the-Art: Computing on Untrusted Systems

  • Acceptable overhead ☺
  • Arbitrary workloads ☺

Related Work:

  • S-FaaS [CoRR abs/1810.06080]

Guest OS Function Runtime Host OS Hypervisor Intel SGX

slide-20
SLIDE 20

What is Intel SGX?

User Application (Untrusted Memory) Operating System

slide-21
SLIDE 21

What is Intel SGX?

  • Adds enclave abstraction

User Application (Untrusted Memory) Enclave Operating System/Hypervisor

slide-22
SLIDE 22

What is Intel SGX?

  • Adds enclave abstraction

○ Encrypted in RAM only

User Application (Untrusted Memory) Enclave Operating System/Hypervisor Encrypted in RAM Unencrypted in CPU cache

slide-23
SLIDE 23

What is Intel SGX?

  • Adds enclave abstraction

○ Encrypted in RAM only ○ Not accessible from outside

User Application (Untrusted Memory) Enclave Operating System/Hypervisor Read, Write Read, Write

slide-24
SLIDE 24

What is Intel SGX?

  • Adds enclave abstraction

○ Encrypted in RAM only ○ Not accessible from outside ○ Developer-specified entry points

User Application (Untrusted Memory) Enclave Operating System/Hypervisor Call Enter Exit Call

slide-25
SLIDE 25

What are the limitations of Intel SGX?

  • High overheads for:

○ Secure memory paging ○ Enclave startup with large heap

User Application (Untrusted Memory) Enclave Operating System/Hypervisor 94MB of HW-encrypted memory available

slide-26
SLIDE 26

Why do Intel SGX limitations matter?

Function startup time as an

  • ptimization target:
  • SAND, SOCK [ATC’18]
slide-27
SLIDE 27

Why do Intel SGX limitations matter?

Function startup time as an

  • ptimization target:
  • SAND, SOCK [ATC’18]

Problem for SGXv1 enclaves

slide-28
SLIDE 28

Why do Intel SGX limitations matter?

Function startup time as an

  • ptimization target:
  • SAND, SOCK [ATC’18]

Problem for SGXv1 enclaves

  • Can be solved with SGXv2

Additional optimizations are worth investigating.

slide-29
SLIDE 29

Problem Statement

How to execute a wide range of user functions in FaaS in a trustworthy and efficient manner?

slide-30
SLIDE 30

Outline

  • Motivation
  • Design
  • Evaluation
  • Summary
slide-31
SLIDE 31

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Based on Apache OpenWhisk

slide-32
SLIDE 32

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Key Mgmt Service Based on Apache OpenWhisk

  • 1. Trustworthy environment for

function execution

slide-33
SLIDE 33

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data Key Mgmt Service Based on Apache OpenWhisk

  • 2. Message format for

secure function chaining

  • 1. Trustworthy environment for

function execution

slide-34
SLIDE 34

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data Key Mgmt Service Based on Apache OpenWhisk

  • 2. Message format for

secure function chaining

  • 1. Trustworthy environment for

function execution

  • 3. Function startup time
  • ptimizations (SGXv2)
slide-35
SLIDE 35

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data Key Mgmt Service Based on Apache OpenWhisk

  • 2. Message format for

secure function chaining

  • 1. Trustworthy environment for

function execution

  • 3. Function startup time
  • ptimizations (SGXv2)
  • 4. Key management and

deployment scheme

slide-36
SLIDE 36

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data Key Mgmt Service Based on Apache OpenWhisk

  • 2. Message format for

secure function chaining

  • 1. Trustworthy environment for

function execution

  • 3. Function startup time
  • ptimizations (SGXv2)
  • 4. Key management and

deployment scheme

slide-37
SLIDE 37

What is Clemmys?

SGX Enclave Native Application

Function A Function B Controller Gateway Function C TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data Key Mgmt Service Based on Apache OpenWhisk

  • 2. Message format for

secure function chaining

  • 1. Trustworthy environment for

function execution

  • 3. Function startup time
  • ptimizations (SGXv2)
  • 4. Key management and

deployment scheme

slide-38
SLIDE 38

Components of Clemmys

  • Internal encryption
  • Function chain verification
  • Function startup optimizations
  • Function deployment and key management
slide-39
SLIDE 39

How does Clemmys secure communication?

Function A Function B Controller Gateway Function C TLS TLS TLS EPC paging → slow!

SGX Enclave Native Application

slide-40
SLIDE 40

How does Clemmys secure communication?

Function A Function B Controller Gateway Function C TLS ??? ???

SGX Enclave Native Application

slide-41
SLIDE 41

How does Clemmys secure communication?

Function A Function B Controller Gateway Function C TLS ??? ???

Idea: separate controller metadata (plaintext) from function arguments (encrypted)

SGX Enclave Native Application

slide-42
SLIDE 42

How does Clemmys secure communication?

Function A Function B Controller Gateway Function C TLS

Idea: separate controller metadata (plaintext) from function arguments (encrypted)

Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data

SGX Enclave Native Application

slide-43
SLIDE 43

Components of Clemmys

  • Internal encryption
  • Function chain verification
  • Function startup optimizations
  • Function deployment and key management
slide-44
SLIDE 44
  • Naive encryption does not preserve function order.

Scale Detect Features Controller Gateway Report & Log TLS Plaintext Metadata + + Encrypted Data

Why should function chain order be enforced?

SGX Enclave Native Application

slide-45
SLIDE 45

Scale Detect Features Controller Gateway Report & Log TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data

  • Naive encryption does not preserve function order.

Why should function chain order be enforced?

SGX Enclave Native Application

slide-46
SLIDE 46

Scale Detect Features Controller Gateway Report & Log TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data

  • Naive encryption does not preserve function order.
  • Message format should preclude these attack vector.

Why should function chain order be enforced?

SGX Enclave Native Application

slide-47
SLIDE 47

Scale Detect Features Controller Gateway Report & Log TLS Plaintext Metadata + + Encrypted Data Plaintext Metadata + + Encrypted Data

  • Naive encryption does not preserve function order.
  • Message format should preclude these attack vector.

Why should function chain order be enforced?

SGX Enclave Native Application

See paper for technical details

slide-48
SLIDE 48

Components of Clemmys

  • Internal encryption
  • Function chain verification
  • Function startup optimizations
  • Function deployment and key management
slide-49
SLIDE 49

Startup Optimizations

1. SGXv1 Enclave Creation

Enclave VM Range Physical Pages

slide-50
SLIDE 50

Startup Optimizations

1. SGXv1 Enclave Creation

Enclave VM Range EPC Size

slide-51
SLIDE 51

Startup Optimizations

1. SGXv1 Enclave Creation

Enclave VM Range EPC Size Paged out!

slide-52
SLIDE 52

Startup Optimizations

1. SGXv1 Enclave Creation

Enclave VM Range EPC Size Paged out!

slide-53
SLIDE 53

Startup Optimizations

1. SGXv2 Enclave Creation

Enclave VM Range Enclave .text and .data sections Metadata for heap allocator SGXv2 allows adding pages at runtime

slide-54
SLIDE 54

Startup Optimizations

1. SGXv2 Enclave Creation

Enclave VM Range Memory access inside enclave SGXv2 allows adding pages at runtime

slide-55
SLIDE 55

Startup Optimizations

1. SGXv2 Enclave Creation

Enclave VM Range Memory access inside enclave Page added (augmented) dynamically SGXv2 allows adding pages at runtime

slide-56
SLIDE 56

Startup Optimizations

1. SGXv2 Enclave Creation 2. EPC Batch Augmentation

Enclave VM Range Memory access inside enclave Page added (augmented) dynamically

slide-57
SLIDE 57

Startup Optimizations

1. SGXv2 Enclave Creation 2. EPC Batch Augmentation

Enclave VM Range Memory access inside enclave Block of N pages augmented at once

slide-58
SLIDE 58

Startup Optimizations

1. SGXv2 Enclave Creation 2. EPC Batch Augmentation

Enclave VM Range Freshly allocated region of heap memory

3. Memory zeroing on deallocation

Need to be explicitly zeroed with SGXv1

slide-59
SLIDE 59

Startup Optimizations

1. SGXv2 Enclave Creation 2. EPC Batch Augmentation

Enclave VM Range Freshly allocated region of heap memory

3. Memory zeroing on deallocation

Guaranteed to be zero-filled with SGXv2

slide-60
SLIDE 60

Startup Optimizations

1. SGXv2 Enclave Creation 2. EPC Batch Augmentation

Enclave VM Range

3. Memory zeroing on deallocation

Zero-filled on memory deallocation

slide-61
SLIDE 61

Components of Clemmys

  • Internal encryption
  • Function chain verification
  • Function startup optimizations
  • Function deployment and key management
slide-62
SLIDE 62

How is Clemmys function deployed?

Function A Function B Function C Controller Gateway Client Palaemon

SGX Enclave Native Application

slide-63
SLIDE 63

How is Clemmys function deployed?

Function A Function B Function C Controller Gateway Client Palaemon

  • Palaemon - remote attestation and configuration service
  • Transparent configuration management:

○ Environment variables and command-line arguments

SGX Enclave Native Application

slide-64
SLIDE 64

Remote Attestation Intel

How is Clemmys function deployed?

Function A Function B Function C Controller Gateway Client Palaemon

SGX Enclave Native Application Trust Established

slide-65
SLIDE 65

Upload configuration (chains, secrets)

How is Clemmys function deployed?

Function A Function B Function C Controller Gateway Client Palaemon

SGX Enclave Native Application Trust Established

slide-66
SLIDE 66

How is Clemmys function deployed?

Function A Function B Function C Controller Gateway Client Palaemon Upload functions (Docker images)

SGX Enclave Native Application Trust Established

slide-67
SLIDE 67

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon

SGX Enclave Native Application Trust Established

slide-68
SLIDE 68

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon Remote attestation via Palaemon at launch

SGX Enclave Native Application Trust Established

slide-69
SLIDE 69

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon

SGX Enclave Native Application Trust Established

slide-70
SLIDE 70

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon TLS API Request

SGX Enclave Native Application Trust Established

slide-71
SLIDE 71

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon TLS API Request

SGX Enclave Native Application Trust Established

slide-72
SLIDE 72

How is Clemmys function invoked?

Function A Function B Function C Controller Gateway Client Palaemon TLS API Request Plaintext Metadata + + Encrypted Data

SGX Enclave Native Application Trust Established

slide-73
SLIDE 73

How is Clemmys function invoked?

Function A Controller Gateway Client Palaemon TLS API Request Plaintext Metadata + + Encrypted Data Worker Platform Plaintext Metadata + + Encrypted Data

SGX Enclave Native Application Trust Established

slide-74
SLIDE 74

How is Clemmys function invoked?

Function A Controller Gateway Client Palaemon TLS API Request Plaintext Metadata + + Encrypted Data Worker Platform Plaintext Metadata + + Encrypted Data 1. Platform launches the enclave using the plaintext metadata

SGX Enclave Native Application Trust Established

slide-75
SLIDE 75

How is Clemmys function invoked?

Function A Controller Gateway Client Palaemon TLS API Request Plaintext Metadata + + Encrypted Data Worker Platform Plaintext Metadata + + Encrypted Data 1. Platform launches the enclave using the plaintext metadata 2. Enclave performs remote attestation and configuration with Palaemon

SGX Enclave Native Application Trust Established

slide-76
SLIDE 76

Plaintext Metadata + + Encrypted Data

How is Clemmys function invoked?

Function A Controller Gateway Client Palaemon TLS API Request Worker Platform Plaintext Metadata + + Encrypted Data 1. Platform launches the enclave using the plaintext metadata 2. Enclave performs remote attestation and configuration with Palaemon 3. Enclave decrypts and processes the request

SGX Enclave Native Application Trust Established

slide-77
SLIDE 77

Outline

  • Motivation
  • Design
  • Evaluation
  • Summary

56

slide-78
SLIDE 78

Gateway Overhead

Function A Function B Function C Controller Gateway Function A Function B Function C Controller Gateway

VS.

SGX Enclave Native Application

slide-79
SLIDE 79

Gateway Overhead

lower ➝ better

slide-80
SLIDE 80

Gateway Overhead

lower ➝ better

Number of functions running on the worker node

slide-81
SLIDE 81

Gateway Overhead

lower ➝ better

slide-82
SLIDE 82

Gateway Overhead

lower ➝ better

slide-83
SLIDE 83

Gateway Overhead

Minimal overhead (~1-5%) over native API Gateway

lower ➝ better

slide-84
SLIDE 84

Function Overhead

Function Controller Gateway Function Controller Gateway

VS.

SGX Enclave Native Application

slide-85
SLIDE 85

Function Overhead

lower ➝ better

slide-86
SLIDE 86

Function Overhead

lower ➝ better

slide-87
SLIDE 87

Function Overhead

lower ➝ better

slide-88
SLIDE 88

Function Overhead

Minimal overhead over native functions (up to 25%)

lower ➝ better

slide-89
SLIDE 89

SGXv2 Optimizations

Function Controller Gateway Function Controller Gateway

VS.

SGX Enclave Native Application

SGXv1 SGXv2

slide-90
SLIDE 90

SGXv2 Optimizations

Speedup normalized by the SGXv1 function run time

slide-91
SLIDE 91

SGXv2 Optimizations

higher ➝ better

slide-92
SLIDE 92

SGXv2 Optimizations

  • SGXv2 - all optimizations
  • SGXv2(NB) - no batched augmentation
  • SGXv2(NB,NO) - no batched augmentation and memory zeroing on deallocation

higher ➝ better

slide-93
SLIDE 93

SGXv2 Optimizations

  • SGXv2 - all optimizations
  • SGXv2(NB) - no batched augmentation
  • SGXv2(NB,NO) - no batched augmentation and memory zeroing on deallocation

higher ➝ better

slide-94
SLIDE 94

SGXv2 Optimizations

  • SGXv2 - all optimizations
  • SGXv2(NB) - no batched augmentation
  • SGXv2(NB,NO) - no batched augmentation and memory zeroing on deallocation

higher ➝ better

slide-95
SLIDE 95

SGXv2 Optimizations

10 times lower latency on Phoenix benchmarks with SGXv2 10% lower latency from additional optimizations on a few benchmarks

higher ➝ better

slide-96
SLIDE 96

Summary

Clemmys is:

  • Secure - protects functions using enclave
  • Fast - achieves near-native performance
  • Flexible - does not restrict workloads
slide-97
SLIDE 97

Summary

Clemmys is:

  • Secure - protects functions using enclave
  • Fast - achieves near-native performance
  • Flexible - does not restrict workloads

Thank You for your attention!

bohdan.trach@tu-dresden.de

slide-98
SLIDE 98

Funding

This project was funded by the European Union’s Horizon 2020 program under grant agreement No. 690588 (Selis), and BMBF No. 03ZZ0517A (FastCloud)