SGX-LKL: Securing the Host OS Interface for Trusted Execution

By Christian Priebe, Divya Muthukumaran, Joshua Lind, Huanzhou Zhu, Shujie Cui, V. Sartakov, Peter R. Pietzuch. 2019

126 citations recorded by the source corpus.

Hardware support for trusted execution in modern CPUs enables tenants to shield their data processing workloads in otherwise untrusted cloud environments. Runtime systems for the trusted execution must rely on an interface to the untrusted host OS to use external resources such as storage, network, and other functions. Attackers may exploit this interface to leak data or corrupt the computation. We describe SGX-LKL, a system for running Linux binaries inside of Intel SGX enclaves that only exposes a minimal, protected and oblivious host interface: the interface is (i) minimal because SGX-LKL uses a complete library OS inside the enclave, including file system and network stacks, which requires a host interface with only 7 calls; (ii) protected because SGX-LKL transparently encrypts and integrity-protects all data passed via low-level I/O operations; and (iii) oblivious because SGX-LKL performs host operations independently of the application workload. For oblivious disk I/O, SGX-LKL uses an encrypted ext4 file system with shuffled disk blocks. We show that SGX-LKL protects TensorFlow training with a 21% overhead.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims (2020, background): “67 Demonstrations to date have been carried out on commodity hardware (CPUs [112] [113] and GPUs [114]) or have secure and verifiable outsourcing of parts of the computation to less secure hardware [115] [116], rather than on hardware directly optimized for machine learning (such as TPUs).”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, methodology): “Consider the following calloc() implementation from musl-libc , an integral part of the SGX-LKL [54] library OS for running unmodiﬁed C applications inside enclaves 5 : In this case, if the product n*=m can be faulted to produce a smaller result, subsequent code may trigger a heap overﬂow,…”