Intel SGX Research Articles

Differentially Oblivious Data Analysis With Intel SGX: Design, Optimization, and Evaluation

A privacy-preserving data analytics system enables a cloud user to perform the distributed job in a secure manner such that the data privacy can be guaranteed during the cloud-outsourced computation. However, many SGX-based solutions are vulnerable to some side-channel attacks, including the access pattern leakage from both network and memory. Several data-oblivious algorithms with full obliviousness have been proposed in the literature, but they are impractical to be used in the cloud due to the expensive computational overhead. In this article, we propose a DPSpark system with the security defined in a notion of <inline-formula><tex-math notation="LaTeX">$(\epsilon,\delta)$</tex-math></inline-formula> -differentially private obliviousness ( <inline-formula><tex-math notation="LaTeX">$(\epsilon,\delta)$</tex-math></inline-formula> -DPO), which relaxes full obliviousness to enable an efficiency improvement. Based on this definition, we present a perturbation-shuffle-analysis (PSA) computing architecture and design several typical differentially oblivious operators. In further, we optimize the system efficiency by reducing the number of oblivious shuffles and choosing an appropriate privacy budget. Finally, we benchmark the system in different parameters. The experimental results show that DPSpark significantly outperforms two state-of-the-art solutions, only with 10.1-85.4 percent additional overhead performing an SGX-based data analysis application.

SEAR: Secure and Efficient Aggregation for Byzantine-Robust Federated Learning

Federated learning facilitates the collaborative training of a global model among distributed clients without sharing their training data. Secure aggregation, a new security primitive for federated learning, aims to preserve the confidentiality of both local models and training data. Unfortunately, existing secure aggregation solutions fail to defend against Byzantine failures that are common in distributed computing systems. In this work, we propose a new secure and efficient aggregation framework, SEAR, for Byzantine-robust federated learning. Relying on the trusted execution environment, i.e., Intel SGX, SEAR protects clients’ private models while enabling Byzantine resilience. Considering the limitation of the current Intel SGX's architecture (i.e., the limited trusted memory), we propose two data storage modes to efficiently implement aggregation algorithms efficiently in SGX. Moreover, to balance the efficiency and performance of aggregation, we propose a sampling-based method to efficiently detect Byzantine failures without degrading the global model's performance. We implement and evaluate SEAR in a LAN environment, and the experiment results show that SEAR is computationally efficient and robust to Byzantine adversaries. Compared to the previous practical secure aggregation framework, SEAR improves aggregation efficiency by 4-6 times while supporting Byzantine resilience at the same time.

Privacy Protection in 5G Positioning and Location-based Services Based on SGX

As the sensitivity of position, the privacy protection in both 5G positioning and its further application in location-based services (LBSs) has been paid special attention and studied. Solutions based on k-anonymity, homomorphic encryption, and secure multi-party computation have been proposed. However, these solutions either require a trusted third party or incur heavy overheads. Besides, there still lacks an integrated solution that can protect privacy for both positioning and LBS provision. Based on Intel SGX, this article proposes a novel light-weight scheme that can protect privacy in both 5G positioning and its further applications in LBS provision in an integrated way. Through secret sharing, the proposed scheme can also support multiple location-based service providers without frequent key exchange. We seriously analyze the security of our scheme. Based on scheme implementation, its efficiency is proved through the performance evaluation conducted over a real-world database.

Operon

The past decade has witnessed the rapid development of cloud computing and data-centric applications. While these innovations offer numerous attractive features for data processing, they also bring in new issues about the loss of data ownership. Though some encrypted databases have emerged recently, they can not fully address these concerns for the data owner. In this paper, we propose an ownership-preserving database (OPDB), a new paradigm that characterizes different roles' responsibilities from nowadays applications and preserves data ownership throughout the entire application. We build Operon to follow the OPDB paradigm, which utilizes the trusted execution environment (TEE) and introduces a behavior control list (BCL). Different from access controls that merely handle accessibility permissions, BCL further makes data operation behaviors under control. Besides, we make Operon practical for real-world applications, by extending database capabilities towards flexibility, functionality and ease of use. Operon is the first database framework with which the data owner exclusively controls its data across different roles' subsystems. We have successfully integrated Operon with different TEEs, i.e. , Intel SGX and an FPGA-based implementation, and various database services on Alibaba Cloud, i.e. , PolarDB and RDS PostgreSQL. The evaluation shows that Operon achieves 71% - 97% of the performance of plaintext databases under the TPC-C benchmark while preserving the data ownership.

Advanced Encryption Standard based Secure IoT Data Transfer Model for Cloud Analytics Applications

The data surge caused by the increase in the use of IoT devices in our day-to-day activities requires careful storage and maintenance systems to ensure the protection and integrity of private information. Users are provided with prospects to use rule-based programs and services that can be interconnected with their devices thereby enabling automation in the prodigious IoT ecosystem. The sensitive IoT data is generally stored and processed in cloud services. This data may be vulnerable to several threats. It is crucial to protect rule-based programs and sensitive IoT information against cyberattacks. The rule-based program and IoT data integrity and confidentiality can be maintained with the help of the framework proposed in this work. An end-to-end data encryption model based on advanced encryption standard and Intel SGX are used to design the framework of the data privacy preservation model. Real as well as simulated IoT device data are used for securely executing the rule-based programs in the SGX to evaluate the proposed framework.

Dynamic Binary Translation for SGX Enclaves

Enclaves, such as those enabled by Intel SGX, offer a hardware primitive for shielding user-level applications from the OS. While enclaves are a useful starting point, code running in the enclave requires additional checks whenever control or data is transferred to/from the untrusted OS. The enclave-OS interface on SGX, however, can be extremely large if we wish to run existing unmodified binaries inside enclaves. This article presents Ratel , a dynamic binary translation engine running inside SGX enclaves on Linux. Ratel offers complete interposition , the ability to interpose on all executed instructions in the enclave and monitor all interactions with the OS. Instruction-level interposition offers a general foundation for implementing a large variety of inline security monitors in thefuture. We take a principled approach in explaining why complete interposition on SGX is challenging. We draw attention to five design decisions in SGX that create fundamental trade-offs between performance and ensuring complete interposition, and we explain how to resolve them in the favor of complete interposition. To illustrate the utility of the Ratel framework, we present the first attempt to offer binary compatibility with existing software on SGX. We report that Ratel offers binary compatibility with over 200 programs we tested, including micro-benchmarks and real applications, such as Linux shell utilities. Runtimes for two programming languages, namely, Python and R, tested with standard benchmarks work out-of-the-box on Ratel without any specialized handling.

Computation on Encrypted Data Using Dataflow Authentication

Encrypting data before sending it to the cloud ensures data confidentiality but requires the cloud to compute on encrypted data. Trusted execution environments, such as Intel SGX enclaves, promise to provide a secure environment in which data can be decrypted and then processed. However, vulnerabilities in the executed program give attackers ample opportunities to execute arbitrary code inside the enclave. This code can modify the dataflow of the program and leak secrets via SGX side channels. Fully homomorphic encryption would be an alternative to compute on encrypted data without data leaks. However, due to its high computational complexity, its applicability to general-purpose computing remains limited. Researchers have made several proposals for transforming programs to perform encrypted computations on less powerful encryption schemes. Yet current approaches do not support programs making control-flow decisions based on encrypted data. We introduce the concept of dataflow authentication (DFAuth) to enable such programs. DFAuth prevents an adversary from arbitrarily deviating from the dataflow of a program. Our technique hence offers protections against the side-channel attacks described previously. We implemented two flavors of DFAuth, a Java bytecode-to-bytecode compiler, and an SGX enclave running a small and program-independent trusted code base. We applied DFAuth to a neural network performing machine learning on sensitive medical data and a smart charging scheduler for electric vehicles. Our transformation yields a neural network with encrypted weights, which can be evaluated on encrypted inputs in \( 12.55 \,\mathrm{m}\mathrm{s} \) . Our protected scheduler is capable of updating the encrypted charging plan in approximately 1.06 seconds.

EnclavePoSt: A Practical Proof of Storage-Time in Cloud via Intel SGX

Data integrity is one of the most critical security concerns for users when using the cloud storage service. However, it is difficult for users to always stay online and frequently interact with storage service providers to ensure continuous data integrity in practice. The existing Proof of Storage-time schemes, enabling verifiable continuous data integrity checking at cost of performance, fail to provide flexible storage period, reliable measurement of storage time, and resistance to the outsourcing attack. In this paper, we propose EnclavePoSt, the first practical Proof of Storage-time via Intel SGX, where the data integrity checking can be automatically executed in a hardware-driven Trusted Execution Environment (TEE), i.e., the enclave, when users are offline. The checking results can be aggregated and efficiently verified by users. Besides, the elapsed time during isolated data integrity checking can be precisely measured, and the storage period is allowed to flexibly change. Lastly, our EnclavePoSt is resistant to the outsourcing attack. The security analysis and evaluations justify that the EnclavePoSt is more practical than previous works.

TFHE-rs: A library for safe and secure remote computing using fully homomorphic encryption and trusted execution environments

Fully Homomorphic Encryption (FHE) and Trusted Execution Environ-ments (TEEs) are complementing approaches that can both secure computa-tions running remotely on a public cloud. Existing FHE schemes are, however, malleable by design and lack integrity protection, making them susceptible to integrity breaches where an adversary could modify the data and corrupt the output. This paper describes how both confidentiality and integrity of remote compu-tations can be assured by combining FHE with hardware based secure enclave technologies. We provide a software library for performing FHE within the Intel SGX TEE, written in the memory-safe programming language Rust to strengthen the internal safety of software and reduce its attack surface. We evaluate a sample application written with our library. We demonstrate that we can feasibly combine these concepts and provide stronger security guar-antees with a minimal development effort.

PANDA: Lightweight non-interactive privacy-preserving data aggregation for constrained devices

Privacy-preserving data aggregation is becoming a demanding necessity for many promising scenarios, e.g., health care analysis. Sensitive data are collected and aggregated in a privacy-preserving approach using current Internet of Things (IoT) technology, leading to immense challenge and consequent interest in developing secure computing algorithms for individual and organizational data. However, most existing solutions focus on specific evaluations (e.g., SUM), and they use heavy cryptographic techniques, which are far from practice for constrained IoT devices. The Trusted Execution Environment (TEE, implemented with Intel SGX) can assist in computing arbitrary functions and avoiding resource-consuming operations. Nevertheless, TEE is subject to several challenges because TEE is vulnerable to limited resource and even function violations, e.g., the attacker may bypass the boundary of TEE. In this paper, we propose a lightweight non-interactive privacy-preserving data aggregation scheme for resource-constrained devices, named PANDA, where TEE is introduced to bypass the trusted entities requirement and heavy overhead. Additionally, PANDA explores the certificate-aided function authorization to prevent leakage from unauthorized functions, and designs the public verifiable certificate management to detect the abnormal behaviors of the host to mitigate the external host compromise. We formalize PANDA with rigorous security analysis to indicate privacy protection against the compromised aggregator and analyst. The evaluation results show that PANDA has constant online communication cost and lightweight computation overhead for constrained devices, which is suitable for IoT applications.

Rphx: Result Pattern Hiding Conjunctive Query Over Private Compressed Index Using Intel SGX

Deploying data storage and query service in an untrusted cloud server raises critical privacy and security concerns. This paper focuses on the fundamental problem of processing conjunctive keyword queries over an untrusted cloud in a privacy-preserving manner. Previous tree-based searchable symmetric encryption (SSE) schemes, such as <i>IBTree</i> and <i>VBTree</i>, can process conjunctive keyword queries in a secure and efficient way. However, these schemes cannot address &#x201C;Result Pattern (<i>RP</i>)&#x201D; leakage, which can be used to recover the keywords contained in a conjunctive keyword query. To combat this challenging problem, we propose a result pattern hiding conjunctive query scheme named <i>Rphx</i> using Intel SGX. In particular, we first propose a new &#x201C;SGX-aware&#x201D; compressed index named <i>VIBT</i> by combining variable-length bloom filter tree, matryoshka filter and online cipher. To achieve <i>RP</i> hiding, we then introduce a new tree-based SSE scheme named <i>Rphx</i> by deploying <i>VIBT</i> to Intel SGX. Security analysis shows that <i>Rphx</i> can enhance the security requirements by hiding <i>RP</i> leakage under the IND-CKA2 security model. Experimental results show that <i>VIBT</i> gains at least <inline-formula> <tex-math notation="LaTeX">$30\times $ </tex-math></inline-formula> improvement in storage efficiency and <i>Rphx</i> can achieve comparable search efficiency comparing with previous works.

Bool Network: An Open, Distributed, Secure Cross-Chain Notary Platform

With the advancement of blockchain technology, hundreds of cryptocurrencies have been deployed. The bloom of heterogeneous blockchain platforms brings a new emerging problem: typically, various blockchains are isolated systems, how to securely identify and/or transfer digital properties across blockchains? There are three main kinds of cross-chain approaches: sidechains/relays, notaries, and hashed time-lock contracts. Among them, notary-based cross-chain solutions have the best compatibility and user-friendliness, but they are typically centralized. To resolve this issue, we present Bool Network – an open, distributed, secure cross-chain notary platform powered by MPC-based distributed key management over evolving hidden committees. More specifically, to protect the identities of the committee members, we propose a Ring verifiable random function ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Ring VRF</i> ) protocol, where the real public key of a VRF instance can be hidden among a ring, which may be of independent interest to other cryptographic protocols. Furthermore, all the key management procedures are executed in the TEE, such as Intel SGX, to ensure the privacy and integrity of partial key components. A prototype of the proposed Bool Network is implemented in Rust language, using Polkadot Substrate.

A Geography-Based P2P Overlay Network for Fast and Robust Blockchain Systems

Numerous blockchain systems with various consensus protocols have emerged to achieve high transaction rates (2<inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula>10K tps). However, their underlying P2P network primitives constrain further improvements due to two problems (i) high message redundancy and (ii) long broadcast convergence time. The first problem is caused by the excessive robustness of the dominant broadcast approach Gossip. All state-of-the-art blockchain systems only tolerate 20-50&#x0025; node failure while Gossip can withstand up to 90&#x0025;. The reason for (ii) is that existing broadcast topologies ignore geographical distances among nodes and incur paths with unnecessarily high latency. We present <small>FRing</small>, a geography-based P2P overlay network for fast and robust broadcast in blockchain systems. <small>FRing</small> has three main features: sufficient robustness, low message redundancy, and fast convergence. To reduce convergence time, <small>FRing</small> forms the network topology by considering geographical proximity. A novel broadcast algorithm based on <small>FRing</small> topology is proposed to lower message redundancy while maintaining sufficient robustness. One major challenge is to eliminate the risk of topology inference by traffic pattern analysis. <small>FRing</small> leverages Intel SGX to guarantee nodes&#x2019; behavior integrity and incorporates pattern obfuscation to prevent traffic pattern analysis. The evaluation shows that <small>FRing</small> improved the throughput of EOS by 220&#x0025; and Hyperledger Fabric by 210&#x0025;.

SRX–Secure Data Backup and Recovery for SGX Applications

Intel SGX improves the security of applications by shielding code and data from untrusted software in enclaves. Since enclaves lose their state when closed, that state has to be sealed, i.e., cryptographically protected with a secret key, and stored outside the enclave boundary. In SGX, the used key is bound to both the enclave and the processor that sealed the data, so it is unfeasible for any enclave in another computer to derive the same secret key to unseal such data. This offers security to the data, but also makes it impossible to recover that data if the original computer is damaged or stolen. In order to support backup and recovery of data sealed by enclaves, we propose SRX, a solution for sharing sealed data amongst a restricted set of SGX-enabled computers executing the same enclave code. Enclaves using SRX have access to common keys to seal and unseal enclave data, allowing the sharing of sealed data among the trusted domain. SRX guarantees that these secret keys are never exposed outside the trusted domain. SRX was implemented and evaluated with two applications: a bitcoin wallet and a password manager.

Efficient and DoS-resistant Consensus for Permissioned Blockchains

Existing permissioned blockchain systems designate a fixed and explicit group of committee nodes to run a consensus protocol that confirms the same sequence of blocks among all nodes. Unfortunately, when such a permissioned blockchain runs on a large scale on the Internet, these explicit committee nodes can be easily turned down by denial-of-service (DoS) or network partition attacks. Although recent studies proposed scalable BFT protocols that run on a larger number of committee nodes, these protocols’ efficiency drops dramatically when only a small number of nodes are attacked.In this paper, we propose a novel protocol named Eges that leverages hardware trusted execution environments (e.g., Intel SGX) to develop a new abstraction called “stealth committee”, which effectively hides a committee into a large pool of fake committee nodes. Eges selects a different stealth committee for each block and confirms the same blocks among all nodes with overwhelming probability. Our evaluation shows that Eges is the first efficient permissioned blockchain’s consensus protocol, which simultaneously satisfies two important metrics: (1) Eges can tolerate tough DoS and network partition attacks; and (2) Eges achieves comparable throughput and latency as existing fastest permissioned blockchains’ consensus protocols. Eges’s source code is available on http://github.com/hku-systems/eges.

Privacy-preserving genotype imputation in a trusted execution environment.

Genotype imputation is an essential tool in genomics research, whereby missing genotypes are inferred using reference genomes to enhance downstream analyses. Recently, public imputation servers have allowed researchers to leverage large-scale genomic data resources for imputation. However, privacy concerns about uploading one's genetic data to a server limit the utility of these services. We introduce a secure hardware-based solution for privacy-preserving genotype imputation, which keeps the input genomes private by processing them within Intel SGX's trusted execution environment. Our solution features SMac, an efficient and secure imputation algorithm designed for Intel SGX, which employs a state-of-the-art imputation strategy also utilized by existing imputation servers. SMac achieves imputation accuracy equivalent to existing tools and provides protection against known side-channel attacks on SGX while maintaining scalability. We also show the necessity of our enhanced security by identifying vulnerabilities in existing imputation software. Our work represents a step toward privacy-preserving genomic analysis services.

An Optimization Methodology for Adapting Legacy SGX Applications to Use Switchless Calls

A recent innovation in the trusted execution environment (TEE) technologies enables the delegation of privacy-preserving computation to the cloud system. In particular, Intel SGX, an extension of x86 instruction set architecture (ISA), accelerates this trend by offering hardware-protected isolation with near-native performance. However, SGX inherently suffers from performance degradation depending on the workload characteristics due to the hardware restriction and design decisions that primarily concern the security guarantee. The system-level optimizations on SGX runtime and kernel module have been proposed to resolve this, but they cannot effectively reflect application-specific characteristics that largely impact the performance of legacy SGX applications. This work presents an optimization strategy to achieve application-level optimization by utilizing asynchronous switchless calls to reduce enclave transition, one of the dominant overheads of using SGX. Based on the systematic analysis, our methodology examines the performance benefit for each enclave transition wrapper and selectively applies switchless calls without modifying the legacy codebases. The evaluation shows that our optimization strategy successfully improves the end-to-end performance of our showcasing application, an SGX-enabled network middlebox.

Hardening cryptographic operations through the use of secure enclaves

With the rising popularity of the cloud, companies lose control of both the hardware and the operating system responsible for hosting their software and data. This means that companies are at risk of losing confidential data when these are utilized in components controlled by a third-party cloud vendor. Secure enclaves can help solve this problem by creating a secure environment where code can be executed securely, guaranteeing that no unwanted parties read or modify the data inside this secure environment.While the use of secure enclaves has been focused on small footprints software, such as the implementation of trusted computing base for distributed protocols, we analyze the strengths and shortcoming of current tools in an effort to further expand the applicability of their use. Given the importance of web servers and their inherent greater exposure to attacks, we explore the hardening of Apache web server through the use of secure enclaves. This was accomplished by making the necessary modifications to further protect its private key from both the operating system and hypervisor. We also provide a performance assessment to quantify the overhead associated with the use of secure enclaves, namely, Intel SGX.

ReliableBox: Secure and Verifiable Cloud Storage With Location-Aware Backup

While the prevalent cloud storage platforms are offering convenient services in support of diverse data-driven applications for clients, various security concerns raise in terms of data confidentiality, availability, and retrievability. Among them, servers' dishonesty on the location-specific data backup becomes a serious concern when the data stands out clients' control, considering the strict regulations imposed by many governments and organizations on data storage location. This article studies location-aware data backup verification for the data stored in clouds and aims to design a secure framework, named as ReliableBox, enabling the clients to verify if their data have been backed up on the remote servers with specific geolocation. In the design of ReliableBox, we leverage the prominent proof-of-storage techniques for data possession proof, and take advantage of multilateration geolocation and Intel SGX for the precise communication delay measurement and trust computing delay measurement, respectively. In ReliableBox, a client first computes integrity tags for the files and then outsources both the files and tags to the cloud storage server. In the later attestation, with the precise network delay and distance measurement from location-known verifiers, the client verifies that the outsourced files are intact and backed-up to hosts at the specific geolocation. With the customized design, ReliableBox can support the security needs in terms of both data integrity and backup location verification for clients, even when there exists potential dishonest cloud service providers who may manipulate the network delays or forge verification proofs. We provide security analysis to show the security property of ReliableBox in terms of data access, confidentiality, and verifications. In the end, we implement the system prototype and deploy it into several prevalent and commercial cloud platforms for performance evaluation. The experimental results demonstrate that ReliableBox is secure in support of data integrity checking and location-aware backup auditing, while it is robust to the data possession and location spoofing attacks.

Remote attestation and integrity measurements with Intel SGX for virtual machines

With response to the emerging virtualization trend, we focus on a Virtual Machine (VM) remote attestation process assuming that it is running in an uncontrolled and untrusted cloud infrastructure.We present a solution that is able to establish a chain of trust in a cloud environment. Our solution is based on a set of CPU instructions and it does not need any additional components to track host modifications. Our solution enables integrity verification of a filesystem. Additionally, it ensures trust level assessment for remote VMs during their startup or while triggered manually at any point in time afterwards.We identify security properties for our solution and show how it meets them. The security analysis shows that with necessary countermeasures, the proposed model can ensure the required level of security. Additionally, We evaluate the performance impact of the prototype and virtualization overhead for a real-life scenario. Here, we assume that small configuration files, binaries, and executables are most critical. The results show that important filesystem components can be verified with a minimum impact on a startup time. This way, the whole proposal allows for making VM a part of a trusted compute resource pool.