不可信云中基于ISA的可信网络功能和服务器应用
ISA-Based Trusted Network Functions And Server Applications In The Untrusted Cloud
摘要：
如今，企业在云中广泛部署网络功能（NF）和服务器应用程序。然而，敏感数据的处理和可信执行不能安全地部署在不可信云中。云提供商本身可能会意外泄露私人信息（例如，由于配置错误）或流氓用户可以利用供应商系统的漏洞来破坏执行完整性，对内部企业和客户数据的机密性构成威胁。在本文中，我们确定了（i）可应用可信执行的NF和服务器应用用例的数量，（ii）损害每个用例的私有数据和执行完整性的资产和影响，以及（iii）我们利用英特尔的Software Guard Extensions（SGX）架构为基于云的NF和服务器应用设计可信执行环境（TEE）。我们将SGX与数据平面开发工具包（DPDK）相结合，针对多种应用场景（针对普通和加密流量的第2层帧和第3层数据包处理、流量负载平衡和后端服务器处理）对我们的TEE进行原型设计和评估。我们的结果表明，涉及普通流量的NF可以实现几乎原生的性能（例如，对于64字节帧的第3层转发，每秒约2200万个数据包），而涉及加密流量和服务器处理的NF仍然可以实现有竞争力的性能（例如，对于64字节帧，服务器处理速度约为每秒1200万个数据包）。
英文摘要：
Nowadays, enterprises widely deploy Network Functions (NFs) and server applications in the cloud. However, processing of sensitive data and trusted execution cannot be securely deployed in the untrusted cloud. Cloud providers themselves could accidentally leak private information (e.g., due to misconfigurations) or rogue users could exploit vulnerabilities of the providers' systems to compromise execution integrity, posing a threat to the confidentiality of internal enterprise and customer data. In this paper, we identify (i) a number of NF and server application use-cases that trusted execution can be applied to, (ii) the assets and impact of compromising the private data and execution integrity of each use-case, and (iii) we leverage Intel's Software Guard Extensions (SGX) architecture to design Trusted Execution Environments (TEEs) for cloud-based NFs and server applications. We combine SGX with the Data Plane Development KIT (DPDK) to prototype and evaluate our TEEs for a number of application scenarios (Layer 2 frame and Layer 3 packet processing for plain and encrypted traffic, traffic load-balancing and back-end server processing). Our results indicate that NFs involving plain traffic can achieve almost native performance (e.g., ~22 Million Packets Per Second for Layer 3 forwarding for 64-byte frames), while NFs involving encrypted traffic and server processing can still achieve competitive performance (e.g., ~12 Million Packets Per Second for server processing for 64-byte frames).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
