VC3: Trustworthy Data Analytics in the Cloud Using SGX

By Felix Schuster, Manuel Costa, Cédric Fournet, Christos Gkantsidis, Marcus Peinado, Gloria Mainar-Ruiz, Mark Russinovich. 2015

675 citations recorded by the source corpus.

We present VC3, the first system that allows users to run distributed MapReduce computations in the cloud while keeping their code and data secret, and ensuring the correctness and completeness of their results. VC3 runs on unmodified Hadoop, but crucially keeps Hadoop, the operating system and the hyper visor out of the TCB, thus, confidentiality and integrity are preserved even if these large components are compromised. VC3 relies on SGX processors to isolate memory regions on individual computers, and to deploy new protocols that secure distributed MapReduce computations. VC3 optionally enforces region self-integrity invariants for all MapReduce code running within isolated regions, to prevent attacks due to unsafe memory reads and writes. Experimental results on common benchmarks show that VC3 performs well compared with unprotected Hadoop: VC3's average runtime overhead is negligible for its base security guarantees, 4.5% with write integrity and 8% with read/write integrity.

Subfields: Artificial Intelligence, Information Systems, ML Systems & Hardware, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In ML Systems & Hardware

In Privacy & Security

Citations in the corpus

Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts (2018, positive): “by employing a similar technique as in [77]) for future work.”
Prochlo: Strong Privacy for Analytics in the Crowd (2017, methodology): “In particular, for the types of data center analytics that would be performed by the ESA analyzer, there have been several proposals in the recent literature [20, 57, 67].”
Contamination Attacks and Mitigation in Multi-Party Machine Learning (2018, methodology): “Each party can verify that the server is running the correct code and only then share the data with it (e.g., using remote attestation if using Intel SGX [20] as described in [33, 37]).”
Machine Learning Models that Remember Too Much (2017, methodology): “Advances in data analytics frameworks based on trusted hardware such as SGX [7, 61, 66] and cryptographic protocols based on secure multi-party computation (see Section 8) may also serve as the basis for secure ML platforms.”
Eleos: ExitLess OS Services for SGX Enclaves (2017, methodology): “Finally, the integration of Eleos adds only a few hundred lines of code into the TCB. VC3 [24] uses SGX to achieve conﬁdentiality and integrity as part of the MapReduce framework.”
The Efficient Server Audit Problem, Deduplicated Re-execution, and the Web (2017, methodology): “This includes TPM-based approaches [27, 44, 58, 59, 66, 71, 74, 79] and systems [14, 17, 48, 73, 77] built on SGX hardware [49].”
A compiler and verifier for page access oblivious computation (2017, methodology): “An enclave (e.g. Hadoop reducer in VC3 [16]) occupies a virtual address space contained within the hosting application’s (e.g. Hadoop process) address space; the enclave’s code runs at the lowest (ring 3) privilege level.”
This paper is included in the Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI ’16). (neutral): “Analogous to prior work [50, 6], we assume a powerful and active adversary who has superuser access to the system and also access to the physical hardware.”
PROCHLO: Strong Privacy for Analytics in the Crowd (2017, methodology): “In particular, for the types of data center analytics that would be performed by the ESA analyzer, there have been several proposals in the recent literature [20, 57, 67].”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (neutral): “VC3 [63] secures trusted MapReduce using SGX. MiniBox [48] uses Native Client and a trusted computing module (TPM) to protect an application and the OS from each other.”
Oblivious Multi-Party Machine Learning on Trusted Processors (2016, methodology): “Haven [8] runs unmodified Windows applications in SGX enclaves, and VC3 [57] proposes a cloud data analytics framework based on SGX.”
Observing and Preventing Leakage in MapReduce (2015, methodology): “As a concrete example, VC3 [24] recently showed that, by relying on the new Intel SGX infrastructure [17] to protect local mapper and reducer processing, one can adapt the popular Hadoop framework [1] and achieve strong integrity and confidentiality for large MapReduce tasks with a small performance”
Komodo: Using verification to disentangle secure-enclave hardware from software (2017, background): “In the short time since the SGX specification was published, a wide range of applications have been devised [e.g., 5, 8, 9, 14, 21, 42, 65, 68, 75], and competing vendors are developing similar features [48].”
Cache Attacks on Intel SGX (2017, methodology): “Even though VC3 is not directly affected by cache-timing attacks on AES, similar attacks might be able to harm the privacy of VC3’s processed data.”
PPFL: privacy-preserving federated learning with trusted execution environments (2021, methodology): “Running ML inside TEEs can hide model parameters from REE adversaries and consequently preserve privacy, as already used for light data analytics on servers [54, 62] and for heavy computations such as DNN training [18, 23, 49, 70].”