SCONE: S ecure Linux Con tainer E nvironments with Intel SGX S. - - PowerPoint PPT Presentation

▶
scone s ecure linux con tainer e nvironments with intel
SMART_READER_LITE
LIVE PREVIEW

SCONE: S ecure Linux Con tainer E nvironments with Intel SGX S. - - PowerPoint PPT Presentation

Aug 25, 2022 284 likes •825 views

SCONE: S ecure Linux Con tainer E nvironments with Intel SGX S. Arnautov, B. Trach, F. Gregor, Thomas Knauth , and A. Martin, Technische Universitt Dresden; C. Priebe, J. Lind, D. Muthukumaran, D. O'Keeffe, and M. Stillwell, Imperial College

slide-1
SLIDE 1

SCONE: Secure Linux Container Environments with Intel SGX

  • S. Arnautov, B. Trach, F. Gregor, Thomas Knauth, and A. Martin, Technische Universität Dresden; C.

Priebe, J. Lind, D. Muthukumaran, D. O'Keeffe, and M. Stillwell, Imperial College London; D. Goltzsche, Technische Universität Braunschweig; D. Eyers, University of Otago; R. Kapitza, Technische Universität Braunschweig; P. Pietzuch, Imperial College London; C. Fetzer, Technische Universität Dresden

thomas.knauth@tu-dresden.de

1

slide-2
SLIDE 2

Trust Issues: The Provider’s Perspective

  • Cloud provider does not trust

users

  • Use virtual machines to isolate

users from each other and the host

  • VMs only provide one way

protection

2

Redis OS VMM Firmware Cloud platform Staff …

trusted

slide-3
SLIDE 3

Trust Issues: The User’s Perspective

  • Users trust their application
  • Users must implicitly trust the

cloud provider

  • Existing applications implicitly

assume trusted operating system

3

Redis OS VMM Firmware Cloud platform Staff …

untrusted

slide-4
SLIDE 4

Containers are the new VMs

  • Containers provide resource

isolation and bundling

  • Smaller resource overhead

than virtual machines

  • Convenient tooling to create

and deploy applications in the cloud

4

slide-5
SLIDE 5

Disaster!

5

OS VMM Firmware Cloud platform Staff …

untrusted

slide-6
SLIDE 6

Disaster!

6

OS VMM Firmware Cloud platform Staff …

untrusted

slide-7
SLIDE 7

Disaster!

7

OS VMM Firmware Cloud platform Staff …

untrusted

slide-8
SLIDE 8

Disaster!

8

OS VMM Firmware Cloud platform Staff …

untrusted

slide-9
SLIDE 9

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

slide-10
SLIDE 10

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

  • run unmodified Linux

applications …

slide-11
SLIDE 11

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

  • run unmodified Linux

applications …

  • in containers …
slide-12
SLIDE 12

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

  • run unmodified Linux

applications …

  • in containers …
  • in an untrusted cloud …
slide-13
SLIDE 13

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

  • run unmodified Linux

applications …

  • in containers …
  • in an untrusted cloud …
  • securely and …
slide-14
SLIDE 14

We want to …

9

OS VMM Firmware Cloud platform Staff …

untrusted

  • run unmodified Linux

applications …

  • in containers …
  • in an untrusted cloud …
  • securely and …
  • with acceptable performance
slide-15
SLIDE 15

10 10

Secure Guard Extensions

  • New enclave processor mode
  • Users can create a HW-

enforced trusted environment

  • Only trust Intel and Secure

Guard Extensions (SGX) implementation

OS VMM Firmware Cloud platform Staff …

untrusted

Enclave

slide-16
SLIDE 16

SGX: HW-enforced Security

  • 18 new instructions to manage

enclave life cycle

  • Enclave memory only

accessible from enclave

  • Certain instructions

disallowed, e.g., syscall

11

… EENTER … Execute … Return privileged access from OS, VMM, SMM forbidden untrusted trusted

slide-17
SLIDE 17

Challenge 1: Interface

  • Haven (OSDI’14): library
  • perating system in enclave
  • Large TCB → more vulnerable
  • Small interface (22 system

calls)

  • Shields protect the interface

12

Application Code Host OS Library OS C Library Libraries Shielding layer Library OS inside TCB

External container interface trusted untrusted

slide-18
SLIDE 18

Challenge 1: Interface

  • Small TCB
  • C library interface is complex
  • Harder to protect

13

Application Code Shim C Library C Library Host OS Libraries Minimal TCB

slide-19
SLIDE 19

Challenge 2: Performance

14

system call frequency
 (1000s/second) 1 100 10000 Threads 1 2 4 8

native synchronous enclave exits

  • pwrite() with 32 byte buffer
  • 4 cores with hyper threading
slide-20
SLIDE 20

Challenge 2: Performance

14

system call frequency
 (1000s/second) 1 100 10000 Threads 1 2 4 8

native synchronous enclave exits

  • pwrite() with 32 byte buffer
  • 4 cores with hyper threading

8×

slide-21
SLIDE 21

Host operating system

SCONE Architecture

15

Libraries Application SCONE module Intel SGX driver Container (cgroups)

slide-22
SLIDE 22

Host operating system

SCONE Architecture

  • Enhanced C library → small

TCB (Challenge 1)

15

SCONE C library Libraries Application SCONE module Intel SGX driver Container (cgroups)

slide-23
SLIDE 23

Host operating system

SCONE Architecture

  • Enhanced C library → small

TCB (Challenge 1)

  • Asynchronous system calls

and user space threading reduce number of enclave exits (Challenge 2)

15

SCONE C library Asynchronous system calls M:N threading Libraries Application SCONE module Intel SGX driver Container (cgroups)

slide-24
SLIDE 24

Host operating system

SCONE Architecture

  • Enhanced C library → small

TCB (Challenge 1)

  • Asynchronous system calls

and user space threading reduce number of enclave exits (Challenge 2)

  • Network and file system

shields actively protect user data

15

SCONE C library Asynchronous system calls M:N threading Network shield File system shield Libraries Application SCONE module Intel SGX driver Container (cgroups)

slide-25
SLIDE 25

Anatomy of a System Call

16

enclave kernel

slide-26
SLIDE 26

read, fd, buf, size

Anatomy of a System Call

17

enclave read(fd, buf, size) [0] [2] kernel T1 [1] system call slots

slide-27
SLIDE 27

read, fd, buf, size

Anatomy of a System Call

18

enclave kernel read(fd, buf, size) S1 T1 [0] [2] [1] system call slots

slide-28
SLIDE 28

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) [0] T1 read, fd, buf, size [0] [2] [1] system call slots

slide-29
SLIDE 29

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) T1 read, fd, buf, size [0] [2] [1] system call slots

slide-30
SLIDE 30

read, fd, buf, size read(fd, buf, size) T2

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) T1 read, fd, buf, size [0] [2] [1] system call slots

slide-31
SLIDE 31

read, fd, buf, size read(fd, buf, size) T2

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) T1 read, fd, buf, size [0] [2] [1] system call slots switch to ready user space thread

slide-32
SLIDE 32

read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) T1 read, fd, buf, size [0] [2] [1] system call slots switch to ready user space thread

slide-33
SLIDE 33

read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size

Anatomy of a System Call

19

enclave kernel read(fd, buf, size) T1 read, fd, buf, size [0] [2] [1] system call slots switch to ready user space thread [2]

slide-34
SLIDE 34

read, fd, buf, size

Anatomy of a System Call

20

enclave kernel read(fd, buf, size) T1 read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size [0] [2] [1] system call slots

slide-35
SLIDE 35

read, fd, buf, size

Anatomy of a System Call

20

enclave kernel read(fd, buf, size) T1 read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size [0] [2] [1] system call slots [0]

#2&$?%

slide-36
SLIDE 36

read, fd, buf, size

Anatomy of a System Call

20

enclave kernel read(fd, buf, size) T1 read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size [0] [2] [1] system call slots switch to ready user space thread [0]

#2&$?%

slide-37
SLIDE 37

read, fd, buf, size

Anatomy of a System Call

20

enclave kernel read(fd, buf, size) T1 read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size [0] [2] [1] system call slots [0]

#2&$?%

slide-38
SLIDE 38

read, fd, buf, size

Anatomy of a System Call

20

enclave kernel read(fd, buf, size) T1 read, fd, buf, size read(fd, buf, size) T2 read, fd, buf, size [0] [2] [1] system call slots [0]

#2&$?% GET K1

decrypt buffer into enclave

slide-39
SLIDE 39

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

slide-40
SLIDE 40

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

  • 1. push

image

slide-41
SLIDE 41

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

  • 1. push

image

  • 2. run
slide-42
SLIDE 42

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

  • 1. push

image

  • 3. pull

image

  • 2. run
slide-43
SLIDE 43

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

  • 1. push

image

  • 3. pull

image

  • 4. execute
  • 2. run
slide-44
SLIDE 44

Container Integration

21

Repository Docker Engine Secure Image Enclave SCONE Client Docker Client

  • 1. push

image

  • 3. pull

image

  • 5. secure

channel

  • 4. execute
  • 2. run
slide-45
SLIDE 45

System call frequency
 (1000s/second) 1 100 10000 Threads 1 2 3 4 5 6 7 8

System Call Performance

22

native async sync

  • pwrite() with 32 byte buffer
  • 4 cores with hyper threading
slide-46
SLIDE 46

System call frequency
 (1000s/second) 1 100 10000 Threads 1 2 3 4 5 6 7 8

System Call Performance

22

native async sync async with 1 thread achieves 80%

  • pwrite() with 32 byte buffer
  • 4 cores with hyper threading
slide-47
SLIDE 47

System call frequency
 (1000s/second) 1 100 10000 Threads 1 2 3 4 5 6 7 8

System Call Performance

22

native async sync async with 1 thread achieves 80%

  • ptimized queue

may help

  • pwrite() with 32 byte buffer
  • 4 cores with hyper threading
slide-48
SLIDE 48

Apache Throughput

23

Latency (seconds) 1 2 3 4 Throughput (requests / second) 15000 30000 45000 60000

glibc async sync 0.8× 0.7×

slide-49
SLIDE 49

Performance Overview

24

Application Throughput w.r.t. native async (%) sync (%) Memcached 120 113 Apache 80 70 NGINX 80 36 Redis 60 20

slide-50
SLIDE 50

Performance Overview

24

Application Throughput w.r.t. native async (%) sync (%) Memcached 120 113 Apache 80 70 NGINX 80 36 Redis 60 20 inline encryption has less overhead

slide-51
SLIDE 51

Performance Overview

24

Application Throughput w.r.t. native async (%) sync (%) Memcached 120 113 Apache 80 70 NGINX 80 36 Redis 60 20 inline encryption has less overhead inline encryption hurts performance with single thread

slide-52
SLIDE 52

Summary

  • Small trusted computing base (0.6× – 2.0× of

native binary size)

  • Low runtime overhead (0.6× – 1.2× of native

throughput)

  • Transparent to the container engine (e.g. Docker)

25