[Paper Review] ISA-Based Trusted Network Functions And Server Applications In The Untrusted Cloud

Spyridon Mastorakis, Tahrina Ahmed+1 more|arXiv (Cornell University)|Feb 20, 2018

Security and Verification in Computing22 references3 citations

TL;DR

This paper proposes Intel SGX-based Trusted Execution Environments (TEEs) for network functions (NFs) and server applications in untrusted cloud environments, combining SGX with DPDK to enable secure, high-performance processing. It achieves near-native performance (e.g., ~22 Mpps for plain traffic) and competitive performance (e.g., ~12 Mpps for encrypted traffic), demonstrating feasibility for trusted cloud networking and computing.

ABSTRACT

Nowadays, enterprises widely deploy Network Functions (NFs) and server applications in the cloud. However, processing of sensitive data and trusted execution cannot be securely deployed in the untrusted cloud. Cloud providers themselves could accidentally leak private information (e.g., due to misconfigurations) or rogue users could exploit vulnerabilities of the providers' systems to compromise execution integrity, posing a threat to the confidentiality of internal enterprise and customer data. In this paper, we identify (i) a number of NF and server application use-cases that trusted execution can be applied to, (ii) the assets and impact of compromising the private data and execution integrity of each use-case, and (iii) we leverage Intel's Software Guard Extensions (SGX) architecture to design Trusted Execution Environments (TEEs) for cloud-based NFs and server applications. We combine SGX with the Data Plane Development KIT (DPDK) to prototype and evaluate our TEEs for a number of application scenarios (Layer 2 frame and Layer 3 packet processing for plain and encrypted traffic, traffic load-balancing and back-end server processing). Our results indicate that NFs involving plain traffic can achieve almost native performance (e.g., ~22 Million Packets Per Second for Layer 3 forwarding for 64-byte frames), while NFs involving encrypted traffic and server processing can still achieve competitive performance (e.g., ~12 Million Packets Per Second for server processing for 64-byte frames).

Motivation & Objective

• To address the critical security challenge of deploying sensitive network functions and server applications in untrusted cloud environments where data confidentiality and execution integrity are at risk.
• To identify specific use-cases in NFs and server applications where trusted execution via Intel SGX can provide meaningful security benefits.
• To design and prototype high-performance TEEs for cloud-based NFs and server workloads using Intel SGX and DPDK.
• To evaluate the performance overhead and trade-offs of SGX-based trusted execution in real-world network processing scenarios.
• To provide insights into system design trade-offs and open issues for future research in secure, high-performance cloud networking.

Proposed method

• Leverages Intel Software Guard Extensions (SGX) to create isolated, hardware-protected enclaves that ensure confidentiality and integrity of sensitive data and code.
• Combines SGX with the Data Plane Development Kit (DPDK) to prototype high-performance data path applications in the cloud.
• Designs TEEs for multiple network processing workloads: Layer 2/3 packet processing (plain and encrypted), load balancing, and backend server processing.
• Minimizes performance overhead by reducing ECALL/OCALL transitions and using untrusted memory buffers where feasible, while managing security trade-offs.
• Employs CPU-based remote and local attestation to verify enclave integrity and authenticity.
• Uses performance measurement and profiling to evaluate throughput (Mpps) and wire throughput (Gbps) across varying frame sizes and server counts.

Experimental results

Research questions

• RQ1 Which network function and server application workloads can benefit most from trusted execution in untrusted cloud environments?
• RQ2 What are the critical assets and threat impacts associated with compromising data confidentiality and execution integrity in these workloads?
• RQ3 How does the integration of SGX with DPDK affect the performance of trusted network functions and server applications?
• RQ4 What are the performance trade-offs and bottlenecks introduced by ECALL/OCALL transitions and memory copy overhead in SGX enclaves?
• RQ5 How do different design approaches (baseline, scaling, packet processing pipeline) impact performance and scalability in SGX-based TEEs?

Key findings

• NFs processing plain traffic achieve near-native performance, reaching approximately 22 million packets per second (Mpps) for 64-byte frames in Layer 3 forwarding.
• NFs handling encrypted traffic and server processing achieve competitive performance, with around 12 Mpps for 64-byte frames in backend server processing.
• Performance degrades with increasing frame size, with throughput dropping to ~9 Mpps for 512-byte frames in 15-server load balancing scenarios.
• ECALL and OCALL transitions introduce significant performance overhead, with additional 5–10% penalties due to memory copy checks during transitions.
• Minimizing ECALL/OCALL frequency and using untrusted memory buffers can improve amortized performance, though at the cost of potential side-channel or data leakage risks.
• Future work is needed to support larger workloads via exit-less services and to integrate trusted standard C libraries to reduce reliance on OCALLs.