Seongmin Kim Youjung Shin Jaehyung Ha A First Step Towards Leveraging Commodity Trusted Execution Environments for Network Applications Seongmin Kim Youjung Shin Jaehyung Ha Taesoo Kim* Dongsu Han KAIST * Georgia Tech

Trend 1: Security and Privacy Critical Factors in Technology Adoption Demands for “security” and “privacy” are increasing Widespread use of Transport Layer Security (TLS) Popularity of anonymity networks (e.g., Tor) Use of strong authentication/encryption in WiFi Expectation on security and privacy impacts design decisions: Operating system (iOS, Android) Apps/services (e.g., messenger, adblocker) Network infrastructure (inter-domain SDN)

Trend 1: Security and Privacy Critical Factors in Technology Adoption Demands for “security” and “privacy” are increasing Widespread use of Transport Layer Security (TLS) Popularity of anonymity networks (e.g., Tor) Use of strong authentication/encryption in WiFi Expectation on security and privacy impacts design decisions: Operating system (iOS, Android) Apps/services (e.g., messenger, adblocker) Network infrastructure (inter-domain SDN) I’d like to start by pointing out two big trends. First, security and privacy are becoming critical factors for technology adoption. Applications and services with enhanced security and privacy features are getting increasingly adopted. And they often impact our design decision. We see many examples like this in today’s market.

Trend 2: Commoditization of Trusted Execution Environment Trusted Execution Environment (TEE) Isolated execution: integrity of code, confidentiality Remote attestation Commoditization of TEE Trusted Platform Module (TPM) : Slow performance ARM TrustZone : Only available for embedded devices Intel Software Guard Extension (SGX) 1. Native performance 2. Compatibility with x86 The commoditization of TEE brings new opportunities for network applications. The second trend is commoditization of trusted execution environments or TEEs. TEEs provide hardware-based mechanisms for isolated execution and remote attestation. While the idea and implementation has been around for a long time, it had several practical limitation. However, the newly released Intel SGX truly signals the commoditization by lifting off some of the limitations ; it gives native performance to software running in the secure mode and is compatible with x86. Imagine all our laptops and servers on the Cloud supportingTEE. We believe that The commoditization of TEE brings new opportunities for network applications because many network and middlebox applications run on x86.

Network Applications + TEE = ? What impact does TEE have on networking? Previous efforts: Adopting TEE to cloud platform Haven [OSDI’14] : Protects applications from an untrusted cloud VC3 [S&P’15] : Trustworthy data analytics in the cloud Network Applications TEE Enhanced security New design space New functionality Intel SGX

SGX : Isolated Execution System Memory CPU Package Enclave Access from OS/VMM Memory Encryption Engine (MEE) Encrypted code/data Snooping SGX allows part of application code to run in isolation inside an enclave. The enclave region of the main memory is encrypted. The content is only decrypted inside the CPU package using processor specific keys. Thus, even if a malicious adversary has full control over the hardware, it cannot access/modify the enclave. Also, the enclave is protected from other software running in the host, including the OS and hypervisor. In summary, the TCB is the CPU package and the application code running inside and enclave. Application keeps its data/code inside the “enclave” Smallest attack surface by reducing TCB (App + processor) Protect app’s secret from untrusted privilege software (e.g., OS, VMM)

SGX : Remote Attestation Remote platform Host platform Hash 1. Request Challenger Enclave 2. Calculate MAC Target Enclave 6. Send signature CMAC 3. Send MAC SGX CPU 4. Verify Quoting Enclave SGX CPU 5. Sign with group key [EPID] SGX also support remote attestation. So an enclave program running on a host makes a remote attestation request. The remote platform creates a hash of the enclave or measurement. Then it passes this info to a specially purposed enclave who signs this with a group key. As part of the remote attestation, one can also exchange information, this is often used for Diffie-Hellman key exchange to bootstrap a secure channel between two enclaves. Attest an application on remote platform Check the identity of enclave (hash of code/data pages) Can establish a “secure channel” between enclaves

Case Studies: Three Applications Network Applications TEE Intel SGX Enhanced security New design space New functionality Network infrastructure: Software-defined inter-domain routing Peer-to-peer systems: Tor anonymity network Middlebox: TLS and “secure” middleboxes

SDN-based Inter-domain Routing Controller 1) Topology 2) Policies (e.g., export policy) AS C AS B AS A AS D Offers new properties Fast convergence, application-specific peering, flexibility, what-if analysis [hotnets2011] Reveals private information: topology and policy

SDN-based Inter-domain Routing Controllers AS C AS B AS A AS D Prior work [hotnets2011] uses Secure Multi-Party Computation (SMPC) to solve this, but the computational complexity is prohibitive.

SDN-based Inter-domain Routing AS A AS-local Controller Router SDN Switch Inter-domain Controller AS B AS-local Controller Enclave Enclave Enclave Enclose private information inside the enclave Communication through a secure channel after attestation

SDN-based Inter-domain Routing AS A AS-local Controller Router SDN Switch Inter-domain Controller AS B AS-local Controller Enclave Enclave Enclave ASes agree upon a common code base. Makes sure that it does not leak private information [Moat]. It becomes the TCB of the inter-domain routing infrastructure.

SDN-based Inter-domain Routing AS A AS-local Controller Router SDN Switch Inter-domain Controller AS B AS-local Controller Attestation Enclave Enclave Enclave Collect info Send routes Agreed upon code 1. Mutually attest/authenticate using remote attestation 2. Collect policy and topology through a secure channel 3. Main controller computes routing path 4. Sends routes for each AS through a secure channel

Extending Features: Policy verification Inter-domain Controller AS A AS C AS D AS B I will give you my shortest route to Google! [SPIDeR] Enabling verification on routing decisions Want to verify whether the promise is being kept [SPIDeR]

Extending Features: Policy verification Among all routes to Google from B, is the one B advertising to A the shortest? AS A AS C AS D AS B Inter-domain Controller Enclave Verify only the predicates agreed upon by A and B Predicate Predicate Add predicate animation I will give you my shortest route to Google! [SPIDeR] Enabling verification on routing decisions Want to verify whether the promise is being kept [SPIDeR]

Tor: Anonymity Network Tor network : uses 3-hop onion routing Directory servers : Advertise available onion routers (ORs), vote for bad exit nodes Relies on volunteer provided hosts When exit node is compromised, (unless end-to-end encryption is used) Snooping or tampering of the plain-text Break of anonymity : Bad apple attack Directory servers Exit Entry Relay Destination Tor client Tor network

Tor: Anonymity Network Tor network : uses 3-hop onion routing Directory servers : Advertise available onion routers, vote for bad exit nodes Relies on volunteer provided hosts When directory servers are compromised, Tie-breaking attacks while voting Admission of malicious ORs Directory servers Exit Entry Relay Destination Tor client Tor network

Application of TEE to Tor 1) SGX-enabled directory servers 2) SGX-enabled directory servers & ORs Enclave Remote attestation Directory servers Enclave Exit - Keep sensitive data in enclave Authority keys List of available ORs - Integrity check each other Entry Relay Destination Tor client - Detect problematic exit nodes through integrity check - Automatic admission of new ORs Tor network

Application of TEE to Tor 1) SGX-enabled directory servers 2) SGX-enabled directory servers & ORs 3) Fully SGX-enabled setting  Eliminate directory servers altogether Remote attestation Enclave Enclave Enclave Exit Enclave Entry Relay Enclave Destination Enclave Tor client Each Tor components can check the integrity of target program (Tor binary) Tor network

Implementation OpenSGX [NDSS’16] : Open source SGX emulator Fully functional, instruction-compatible emulator of SGX build on top of QEMU Emulates system software and provide SGX libraries User process (single address space) Enclave Program Package Info (Key, Entry point) Code SGX Libraries Data Stack Trampoline SGX System call Enclave mode switch SGX OS Emulation SGX instruction QEMU SGX

Preliminary Evaluation: Overhead Estimate the overhead in terms of additional CPU cycles Each SGX instruction = 10 k cycles [Haven] <Cost of remote attestation> <Cost of packet transmission> SGX library Enclave … send() ... User space OS Trampoline CPU Cycles (B) For each I/O operations, 2 Mode switches + SGX library calls Cost of remote attestation: 3% of 1024-bit Diffie-Hellman

SDN-based inter-domain routing 30 ASes with the centralized inter-domain controller Inter-domain controller : 90% more CPU cycles AS-local controllers : 70% more CPU cycles <# of CPU cycles consumed in the inter-domain controller> Number of participating ASes : 30 CPU Cycles

Conclusion Commoditization of TEE brings new opportunities for network applications Cases studies show wide range of impact: Policy privacy of SDN-based inter-domain routing New design space of Tor anonymity network Secure in-network functions SDN-based inter-domain routing: Characterize and measure the overhead of using SGX Consumes 70-90% more CPU cycles

SDN-based inter-domain routing 30 ASes with the centralized inter-domain controller Inter-domain controller : 90% more CPU cycles AS-local controllers : 70% more CPU cycles <# of CPU cycles consumed in the inter-domain controller> CPU Cycles Number of participating ASes

Secure Multi-party Execution SGX Program owner can remotely verify the integrity of code Publicly available programs (e.g., git) can validate the integrity of project by sharing the private key for the attestation Creates signature of program through shared private key Public repo Example) 1. Tor binary for OR 2. SDN-based controller program attestation

In-network Functions (Middleboxes) Use of TLS protocol disrupts in-network processing  Only endpoints of communication can access the plain-text SGX enables opportunity for secure in-network functions Enclave Proxy Firewall IDS Enclave 1. Authenticate middlebox through remote attestaion Enclave 2. Gives session keys through a secure channel Middlebox Server Can be done unilaterally or bilaterally.

Trend 2: Commoditization of Trusted Execution Environment Trusted Execution Environment (TEE) Isolated execution: integrity of code, confidentiality Remote attestation Commoditization of TEE Trusted Platform Module (TPM) : Slow performance ARM TrustZone : Only available for embedded devices Intel Software Guard Extension (SGX) 1. Native performance 2. Compatibility with x86 The commoditization of TEE brings new opportunities for network applications.