Policy-Sealed Data: A New Abstraction for Building Trusted Cloud - - PowerPoint PPT Presentation
Max Planck Institute for Software Systems Policy-Sealed Data: A New Abstraction for Building Trusted Cloud Services Nuno Santos 1 , Rodrigo Rodrigues 2 , Krishna P. Gummadi 1 , Stefan Saroiu 3 MPI-SWS 1 , CITI / Universidade Nova Lisboa 2 ,
Max Planck Institute for Software Systems
Nuno Santos1, Rodrigo Rodrigues2, Krishna P. Gummadi1, Stefan Saroiu3 MPI-SWS1, CITI / Universidade Nova Lisboa2, Microsoft Research3
11/5/15 Nuno Santos 2
1.
} e.g., nested virtualization:
2.
} Trusted Platform Module (TPM)
11/5/15 Nuno Santos 3
11/5/15 Nuno Santos 4
} TPMs root-of-trust not transferable from one node to another
} TPMs abstractions can reveal node’s identity and details of the
} TPMs’ poor performance may introduce bottlenecks
11/5/15 Nuno Santos 5
} Data is handled only by nodes satisfying customer-chosen policy } Examples:
} Handle data only by nodes running CloudVisor } Handle data only by nodes located in the EU
} Binds policies and node attributes to node configurations } Ciphertext-Policy Attribute-Based Encryption [Bethencourt07]
11/5/15 Nuno Santos 6
} Customer data accessible to any node
} Only high-level attributes are revealed
} Enforcing policies does not require
11/5/15 Nuno Santos 7
} Monitor } CP-ABE
11/5/15 Nuno Santos 8
} reboot nodes } install software platform } access disk } eavesdrop network
} e.g., scrape TPMs to learn
} monitor } secure hypervisor
11/5/15 Nuno Santos 9
} Monitor } CP-ABE
Hypervisors
11/5/15 Nuno Santos 10
Policy-Sealed Data
Secure Commodity
11/5/15 11
} node id à hardware attributes } software config à software attributes
} Logic expressions over attributes
Nuno Santos
service = “EC2” and and hypervz = “CloudVisor” and and version >= “1” and and (country = “Germany”
country = “UK”) service : “EC2” hypervz : “CloudVisor” version : “1” country : “Germany” zone : “z1”
11/5/15 Nuno Santos 12
} Monitor } CP-ABE
11/5/15 Nuno Santos
13
} Monitor attests
} CP-ABE
Policy-Sealed Data
11/5/15 Nuno Santos 14
} Hides low-level details from users
} e.g., nodes’ locations (EU vs. US)
} Customers only need to attest the
11/5/15 Nuno Santos 15
}
Ciphertext-Policy Attribute-Based Encryption [Bethencourt07]
Master Key Decryption Key Attributes
Encryption Key
Policy-Sealed Data
11/5/15 Nuno Santos 16
} Monitor } CP-ABE
11/5/15 Nuno Santos 17
} What is the overhead of policy-sealed data? } Is the monitor a scalability bottleneck?
} Based on Eucalyptus / Xen cloud platform } Supports location attribute } Interposed seal / unseal in
} Intel Xeon, 2.83Ghz 8-core CPU, 1.6 GB RAM, TPM v1.2
11/5/15 18
Nuno Santos
11/5/15 Nuno Santos 19
} Max throughput: 630 attestation-verifications/sec } E.g., 10K node cluster attests in ~15 seconds
} Max throughput: 4800 attestation-requests/sec } Increases throughput of standard TPM attestation
} Batches multiple attestation requests into single TPM call
} Speedup orders of magnitude over standard TPM attestation
11/5/15 20
} Flexible sealed storage } Reduce overexposure
} Masks low performance of TPMs
Nuno Santos