TRUSTED MEMORY Software-Based O-Chip Memory Protection for RISC-V - - PowerPoint PPT Presentation

▶
trusted memory
SMART_READER_LITE
LIVE PREVIEW

TRUSTED MEMORY Software-Based O-Chip Memory Protection for RISC-V - - PowerPoint PPT Presentation

Nov 02, 2022 206 likes •706 views

TRUSTED MEMORY Software-Based O-Chip Memory Protection for RISC-V Trusted Execution Environments Gui Andrade Krste Asanovi Dayeol Lee David Kohlbrenner Dawn Song University of California, Berkeley TRUSTED MEMORY? Securing data/code

slide-1
SLIDE 1

Gui Andrade Dayeol Lee David Kohlbrenner

TRUSTED MEMORY

Software-Based O-Chip Memory Protection for RISC-V Trusted Execution Environments

Krste Asanović Dawn Song

University of California, Berkeley

slide-2
SLIDE 2

TRUSTED MEMORY?

Securing data/code against snooping/reverse-engineering

Cryptographic keys Proprietary algorithms Biometric data Code obscurity (defense-in-depth) Personally identifiable information

slide-3
SLIDE 3

TRUSTED MEMORY?

Two security domains of system memory:

  • n-chip and ofg-chip.

On-chip presumed secure,

  • fg-chip not quite
slide-4
SLIDE 4

TRUSTED MEMORY?

Two security domains of system memory:

  • n-chip and ofg-chip.

On-chip presumed secure,

  • fg-chip not quite

O-chip memory a determined hobbyist (!) could compromise On-chip memory extremely dicult (expensive) to compromise

slide-5
SLIDE 5

TRUSTED MEMORY?

Two security domains of system memory:

  • n-chip and ofg-chip.

On-chip presumed secure,

  • fg-chip not quite

O-chip memory some gigabytes of storage On-chip memory some megabytes of storage

slide-6
SLIDE 6

TRUSTED MEMORY?

Two security domains of system memory:

  • n-chip and ofg-chip.

On-chip presumed secure,

  • fg-chip not quite

Hifive Unleashed

(to scale)

Ofg-chip RAM On-chip RAM

slide-7
SLIDE 7

also, who’s this Determined Hobbyist?

slide-8
SLIDE 8

also, who’s this Determined Hobbyist?

the person trying to dump their game console RAM

(“neimod” soldered FPGA I/O to this Nintendo 3DS’s memory bus)

slide-9
SLIDE 9

Confidentiality Integrity

Problems

“can an attacker read my data?” “can an attacker secretly change my data?” chonge

slide-10
SLIDE 10

Today

Keystone Framework intro Prior art in Intel SGX Protected paging Evaluation Conclusion

1 2 3 4 5

slide-11
SLIDE 11

Our Toolset?

slide-12
SLIDE 12

an extensible, customizable

Trusted Execution Environment

framework for RISC-V

slide-13
SLIDE 13

OS / Hypervisor RAM

Ring 0 - 2 Ring 3

Other Apps

Trustworthy Hardware

Trusted Execution Environments

slide-14
SLIDE 14

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps

Trustworthy Hardware

Trusted Execution Environments

slide-15
SLIDE 15

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps

Trustworthy Hardware

Sensitive App Enclave

Enclave Memory

Trusted Execution Environments

slide-16
SLIDE 16

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps

Trustworthy Hardware

Sensitive App Enclave

Enclave Memory

Trusted Execution Environments

Integrity Confidentiality

Remote Attestation

slide-17
SLIDE 17

Cloud provider RAM

Ring 0 - 2 Ring 3 Trusted Untrusted Competitor

Trustworthy Hardware

ML Training/ Inference

Enclave Memory

Trusted Execution Environments

Integrity Confidentiality

Remote Attestation

slide-18
SLIDE 18

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps Sensitive App Enclave

Enclave Memory

Perfect! but...

On-chip memory some megabytes of storage

slide-19
SLIDE 19

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps Sensitive App Enclave

Enclave Memory

Perfect! but...

On-chip memory exhausted very quickly

slide-20
SLIDE 20

OS / Hypervisor RAM

Ring 0 - 2 Ring 3 Trusted Untrusted

Other Apps Sensitive App Enclave

Enclave Memory

On-chip memory exhausted very quickly

Perfect! but...

demand paging

slide-21
SLIDE 21

Confidentiality Integrity

Problems

“can an attacker read my pages?” “can an attacker secretly change my pages?” chonge

slide-22
SLIDE 22

Encryption Hashing

Solutions

any outbound pages are encrypted any inbound pages have their hashes checked

slide-23
SLIDE 23

Confidentiality Integrity

Precedent

Intel’s Secure Guard Extensions solve in hardware

slide-24
SLIDE 24

Carter-Wegman MAC, 56-bit Merkle tree hash storage

Confidentiality Integrity

Precedent

Modified AES-CTR, 128-bit Version counters for replay protection 512b block granularity

slide-25
SLIDE 25

SHA256 Merkle tree hash storage

Confidentiality Integrity

A Software Approach

AES-CTR, 256-bit Version counters for replay protection

for commodity RISC-V hardware

page size granularity (multiple

  • f 4096b)
slide-26
SLIDE 26

s_hash := sha(s)

The Scheme

slide-27
SLIDE 27

The Scheme

s_hash := sha(s) s_enc := aes(s)

slide-28
SLIDE 28

The Scheme

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d)

slide-29
SLIDE 29

The Scheme

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d) d_hash := aes(d_dec)

slide-30
SLIDE 30

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d) d_hash := aes(d_dec) check_hash(d_hash)

The Scheme

slide-31
SLIDE 31

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d) d_hash := aes(d_dec) check_hash(d_hash) store_hash(s_hash)

The Scheme

slide-32
SLIDE 32

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d) d_hash := aes(d_dec) check_hash(d_hash) store_hash(s_hash)

The Scheme

Why a tree?

Array of page hashes too big (wasteful) for

  • n-chip memory

Move it o-chip

slide-33
SLIDE 33

s_hash := sha(s) s_enc := aes(s) d_dec := aes(d) d_hash := aes(d_dec) check_hash(d_hash) store_hash(s_hash)

The Scheme

Why a tree?

O-chip hashes Untrusted hashes?

slide-34
SLIDE 34

Confidentiality Integrity

Problems

“can an attacker read my hashes?” “can an attacker secretly change my hashes?” chonge

slide-35
SLIDE 35

Don’t care! More hashing!

Solutions

cryptographic hashes leak no information hash the hash store, keep the root hash safe

slide-36
SLIDE 36

Trusted world Untrusted world

Hash store

sha(p3) sha(p4) sha(p5) sha(p6) sha(p7) sha(p2) sha(p1) sha(p1)

Resident pages Non-resident pages User OS

Hashing the store

Enclave memory

Original plan: Keep nonresident page hashes in secure memory Problem: On-chip memory too valuable!

slide-37
SLIDE 37

Hashing the store

Trusted world Untrusted world

Hash store

sha(p3) sha(p4) sha(p5) sha(p6) sha(p7) sha(p2) sha(p1) sha(p1)

Resident pages Non-resident pages User OS Enclave memory

Root hash

sha(hash store)

Solution: Move store

  • fg-chip, check its

integrity during page swaps Problem: Hashing the entire store wastes CPU cycles

slide-38
SLIDE 38

Hashing the store

Trusted world Untrusted world

Hash store

sha(p3) sha(p4) sha(p5) sha(p6) sha(p7) sha(p2) sha(p1) sha(p1)

Resident pages Non-resident pages User OS Enclave memory

Root hash

sha(left block || right block)

Solution:

  • Split hash store
  • Hash left or right

side as needed

  • Propagate to root

Problem: Hashing half of store still too much for one page swap

slide-39
SLIDE 39

Hashing the store

Trusted world Untrusted world

Resident pages Enclave memory

Root hash

sha(left node || right node)

Non-resident pages User OS

Hash store

sha(p3) sha(p4) sha(p5) sha(p6) sha(p7) sha(p2) sha(p1) sha(p1) sha(left block || right block) sha(left block || right block)

Solution:

  • Recursive splits
  • Hash only the

relevant leaf

  • Propagate to root

This tree structure is called a Merkle Tree.

slide-40
SLIDE 40

Hashing the store

Trusted world Untrusted world

Resident pages Enclave memory

Root hash

sha(left node || right node)

Non-resident pages User OS

Hash store

sha(p3) sha(p4) sha(p5) sha(p6) sha(p7) sha(p2) sha(p1) sha(p1) sha(left node || right node) sha(left node || right node) sha(left || right) sha(left || right) sha(left || right) sha(left || right)

Merkle tree tradeofgs:

  • Very little secure

memory usage

  • Deeper tree needs

more insecure mem

  • Deeper tree hashes

fewer bytes total

  • Deeper tree needs

more hash passes

slide-41
SLIDE 41

Evaluation

Software memory protection feasible, with appreciable overhead. Optimizations pending; current implementation conservative with security guarantees

slide-42
SLIDE 42

Evaluation

With effjcient paging infrastructure, even unoptimized protection routines could be viable.

slide-43
SLIDE 43

Evaluation

Unfortunately, paging currently accounts for huge runtime overheads

slide-44
SLIDE 44

Conclusion

Protected paging appropriate for security-critical, speed-flexible operations Specifically, ones under secure memory pressure

slide-45
SLIDE 45

Conclusion

Protected paging lays groundwork for other space optimizations

  • Free up L2 cache when enclave is idle
  • Balance on-chip memory among several

enclaves

slide-46
SLIDE 46

A Flexible Approach

slide-47
SLIDE 47

Conclusion

Software protections need no special IP blocks!

Frees up die area for cost constrained hardware

slide-48
SLIDE 48

Conclusion

Software protections are complemented by special IP blocks!

One scheme parametrizable over many hardware configurations