[Paper Review] Rollback and Forking Detection for Trusted Execution Environments using Lightweight Collective Memory

Marcus Brandenburger, Christian Cachin+2 more|arXiv (Cornell University)|Jan 4, 2017

Security and Verification in Computing27 references6 citations

TL;DR

This paper proposes Lightweight Collective Memory (LCM), a protocol that enables clients to detect rollback and forking attacks in trusted execution environments (TEEs) like Intel SGX by maintaining a collective, consistent view of application state using only client-side operations. LCM ensures fork-linearizability and operation stability with minimal overhead—achieving 0.72x to 0.98x the throughput of an SGX-secured key-value store while eliminating reliance on slow trusted non-volatile counters.

ABSTRACT

Novel hardware-aided trusted execution environments, as provided by Intel's Software Guard Extensions (SGX), enable to execute applications in a secure context that enforces confidentiality and integrity of the application state even when the host system is misbehaving. While this paves the way towards secure and trustworthy cloud computing, essential system support to protect persistent application state against rollback and forking attacks is missing. In this paper we present LCM - a lightweight protocol to establish a collective memory amongst all clients of a remote application to detect integrity and consistency violations. LCM enables the detection of rollback attacks against the remote application, enforces the consistency notion of fork-linearizability and notifies clients about operation stability. The protocol exploits the trusted execution environment, complements it with simple client-side operations, and maintains only small, constant storage at the clients. This simplifies the solution compared to previous approaches, where the clients had to verify all operations initiated by other clients. We have implemented LCM and demonstrated its advantages with a key-value store application. The evaluation shows that it introduces low network and computation overhead; in particular, a LCM-protected key-value store achieves 0.72x - 0.98x of a SGX-secured key-value store throughput.

Motivation & Objective

• To address the lack of persistent state integrity protection in TEEs like Intel SGX, which are vulnerable to rollback and forking attacks.
• To provide a solution that ensures fork-linearizability without relying on trusted non-volatile counters or complex client-to-client verification.
• To minimize performance overhead by using only constant-size client-side storage and lightweight cryptographic operations.
• To enable application migration across TEEs while preserving rollback and forking detection capabilities.
• To demonstrate practical feasibility through a prototype key-value store secured with LCM.

Proposed method

• LCM establishes a collective memory among clients using lightweight cryptographic primitives and trusted execution environment (TEE) properties.
• Each client maintains a local copy of a shared state log, updated via authenticated messages from the TEE-protected application.
• The protocol enforces fork-linearizability by ensuring that operations are ordered consistently across clients based on a common versioning mechanism.
• Operation stability is determined when a majority of clients have acknowledged a given operation, using a quorum-based mechanism.
• LCM avoids direct client-to-client communication by leveraging the TEE to authenticate and propagate state updates.
• The system uses a Merkle tree structure to efficiently verify state consistency and detect tampering.

Experimental results

Research questions

• RQ1 Can a lightweight, client-side protocol detect rollback and forking attacks in TEEs without relying on trusted non-volatile counters?
• RQ2 How can fork-linearizability be enforced in a TEE environment with minimal performance overhead?
• RQ3 What is the performance impact of adding collective memory coordination to a TEE-protected application?
• RQ4 Can LCM support application migration across different TEE instances while preserving security guarantees?
• RQ5 How does LCM compare to existing approaches in terms of security, consistency, and efficiency?

Key findings

• LCM achieves 0.72x to 0.98x the throughput of an SGX-secured key-value store, demonstrating low performance overhead.
• The protocol successfully detects rollback and forking attacks by maintaining a consistent, collective view of application state across clients.
• LCM ensures fork-linearizability without requiring direct client-to-client communication or trusted non-volatile counters.
• Operation stability is reliably determined when a majority of clients have acknowledged an operation, enabling clients to reason about consistency.
• The system supports application migration across TEEs while preserving rollback and forking detection capabilities.
• The evaluation shows that LCM outperforms previous approaches relying on trusted counters, which introduce 35–95 ms latency per operation.