Table of Links Abstract and I. Introduction Abstract and I. Introduction II. Background II. Background III. Paranoid Stateful Lambda III. Paranoid Stateful Lambda IV. SCL Design IV. SCL Design V. Optimizations V. Optimizations VI. PSL with SCL VI. PSL with SCL VII. Implementation VII. Implementation VIII. Evaluation VIII. Evaluation IX. Related Work IX. Related Work X. Conclusion, Acknowledgment, and References X. Conclusion, Acknowledgment, and References II. BACKGROUND A. Secure Enclaves A. Secure Enclaves Our design does not assume specific secure enclave hardware or a set of supported instructions; we only require the trusted hardware to have semantics for memory protection and attestation. Here, we introduce Intel Software Guard Extensions (SGX) [15] due to its wide adoption. SGX allows users to create a secure, isolated environment protected from the privileged host OS, hypervisor, or any hardware devices connected to the host. SGX protects against physical adversaries and uses a hardware Memory Encryption Engine (MEE) to guarantee the confidentiality and integrity of enclave memory. All enclave memory must occupy a specific section of memory in the enclave page cache (EPC). If an EPC page is evicted, it is encrypted and stored onto the disk. An EPC page that is loaded back into memory is integrity checked and decrypted. The host OS is still responsible for mapping page tables and allocating memory, but subsequent memory accesses are checked by SGX. SGX ensures that enclave memory can only be accessed by the specific enclave the page is allocated to when walking the page table. In SGXv1, the EPC is a limited resource and has a static limit of 128MB shared across all enclaves, while SGXv2 dynamically allocates an EPC that can be oversubscribed by multiple secure enclaves. SGX can also verify the identity of an application running inside a secure enclave. Intel allows for an attestation report of an enclave to be generated. This report includes a measurement of the code and data sections of the application binary signed by a hardware root of trust and can be verified through Intel’s Attestation Services (IAS). Intel’s Attestation Services B. DataCapsules and the Global Data Plane B. DataCapsules and the Global Data Plane We briefly discuss the benefits of adopting DataCapsules [29] as the underlying storage objects for PSLs. DataCapsules are bundles of data containing data chunks (“records”), along with cryptographic relationships between these records (i.e. hashes) and proofs of membership and/or provenance for these records (i.e. signatures); see Figure 2. DataCapsules have an owner, which is a public/private key pair. Anyone with the private owner key can add records to a DataCapsule but cannot modify existing records. Consequently, write operations are appendonly and must be accompanied by a signature from the DataCapsule owner. Read operations return a proof of membership, consisting of a signature and a chain of hashes along with data. Thus, it is possible to perform secure operations on remote DataCapsules embedded within the network. owner signature proof of membership The Merkle-tree structure of hashes and signatures within a DataCapsule provides two major benefits: First, it is a Conflict-Free Replicated Data Type (CRDT). This means any two partial DataCapsule replicas can be easily synchronized by simply taking the union of records between them; the resulting tree is uniquely defined by the backlinks (hashes). Second, it prevents malicious parties from forging records or corrupting existing records; the worst that a malicious party could do with a DataCapsule is executing a freshness attack by denying the presence of recent records. Freshness attacks can be prevented or mitigated in a variety of ways, including replication, periodic timestamping of records, and caching of pointers to the most recent records. For our PSL infrastructure, we start by requesting the most recent records from a trusted service provider, then maintain the most recent “wavefront” of signed records within our active enclaves. As a result of their hardened nature, DataCapsules can migrate to the edge and benefit from its storage and networking resources. First Second freshness attack service provider Since DataCapsules can be viewed as secure logs, they can encapsulate a wide variety of storage “patterns,” such as key-value stores (in this paper), filesystems, data streams, and databases. All that is required to implement such patterns is a layer of software, called a common access API (CAAPI), common access API that accepts standard user requests (e.g. POSIX filesystem requests) and translates them to operations on the underlying DataCapsule. Such CAAPIs run in secure enclaves, since they need access to cryptographic keys to produce signatures and to encrypt/decrypt information over the DataCapsule API. e.g In this paper, we assume that DataCapsules reside in some network server that is able satisfy DataCapsule read and write operations. However, the true power of DataCapsules is revealed in the context of a data-centric network such as the Global Data Plane (GDP) [29]. Each DataCapsule has a unique 256-bit identity derived from a hash over the public owner key and other metadata. The GDP can route messages to a DataCapsule using its identity rather than a location (i.e. an IP address). Thus, a data client can send reads and writes to a DataCapsule without knowing its location[4]. Thus, with the GDP, PSLs could launch anywhere and access their data simply by possessing (1) the unique identity of the DataCapsule containing its data, (2) the cryptographic ownership and encryption keys for the DataCapsule, and (3) a connection into the GDP. using its identity Authors:
(1) Kaiyuan Chen, University of California, Berkeley (kych@berkeley.edu);
(2) Alexander Thomas, University of California, Berkeley (alexthomas@berkeley.edu);
(3) Hanming Lu, University of California, Berkeley (hanming lu@berkeley.edu);
(4) William Mullen, University of California, Berkeley (wmullen@berkeley.edu);
(5) Jeff Ichnowski, University of California, Berkeley (jeffi@berkeley.edu);
(6) Rahul Arya, University of California, Berkeley (rahularya@berkeley.edu);
(7) Nivedha Krishnakumar, University of California, Berkeley (nivedha@berkeley.edu);
(8) Ryan Teoh, University of California, Berkeley (ryanteoh@berkeley.edu);
(9) Willis Wang, University of California, Berkeley (williswang@berkeley.edu);
(10) Anthony Joseph, University of California, Berkeley (adj@berkeley.edu);
(11) John Kubiatowicz, University of California, Berkeley (kubitron@berkeley.edu). Authors: Authors: (1) Kaiyuan Chen, University of California, Berkeley (kych@berkeley.edu); (2) Alexander Thomas, University of California, Berkeley (alexthomas@berkeley.edu); (3) Hanming Lu, University of California, Berkeley (hanming lu@berkeley.edu); (4) William Mullen, University of California, Berkeley (wmullen@berkeley.edu); (5) Jeff Ichnowski, University of California, Berkeley (jeffi@berkeley.edu); (6) Rahul Arya, University of California, Berkeley (rahularya@berkeley.edu); (7) Nivedha Krishnakumar, University of California, Berkeley (nivedha@berkeley.edu); (8) Ryan Teoh, University of California, Berkeley (ryanteoh@berkeley.edu); (9) Willis Wang, University of California, Berkeley (williswang@berkeley.edu); (10) Anthony Joseph, University of California, Berkeley (adj@berkeley.edu); (11) John Kubiatowicz, University of California, Berkeley (kubitron@berkeley.edu). This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv available on arxiv [4] When multiple DataCapsules exist with the same identity, they are assumed to be equivalent; thus the GDP will try to route queries to the “closest” equivalent DataCapsule. Replication thus provides a mechanism for content distribution, providing a cryptographically hardened form of CDN with well-defined, in-network update semantics, unlike alternatives such as NDN [47].

Part of HackerNoon's growing list of open-source research papers, promoting free access to academic material.

Why DataCapsules and Secure Enclaves Are Crucial for Tomorrow’s Internet

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

15 Common Types of Unethical Behavior Found in Open-Source Projects

Why Your Next Serverless App May Run on “Paranoid” Lambdas

Are PSLs the Next Big Thing After Serverless? Here’s What You Need to Know

Why SCL Uses Lamport Clocks (Not Vector Clocks) to Stay Consistent

SCL: A Secure Concurrency Layer For Paranoid Stateful Lambdas: Optimizations

15 Common Types of Unethical Behavior Found in Open-Source Projects

Why Your Next Serverless App May Run on “Paranoid” Lambdas

Are PSLs the Next Big Thing After Serverless? Here’s What You Need to Know

Why SCL Uses Lamport Clocks (Not Vector Clocks) to Stay Consistent

SCL: A Secure Concurrency Layer For Paranoid Stateful Lambdas: Optimizations

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps