신뢰 실행 환경 어플리케이션 개발을 위한 상용 컨피덴셜 컴퓨팅 프레임워크 동향 및 비교 분석
Analyzing Trends of Commoditized Confidential Computing Frameworks for Implementing Trusted Execution Environment Applications
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
신뢰 실행 환경(TEE, Trusted Execution Environment) 기술의 발전과 함께 신뢰성을 보장하지 못하는 클라우드 환경에서도 어플리케이션의 코드 및 데이터를 보호할 수 있는 컨피덴셜 컴퓨팅(confidential computing)이 차세대 클라우드 핵심 기술로 떠올랐다. 학계뿐만 아니라 산업계에서도 Intel SGX 기술을 중심으로 컨피덴셜 컴퓨팅 솔루션 상용화가 활발히 이루어졌다. 하지만 TEE 기술 기반 어플리케이션을 구현하고자 할 때, 다양한 선택지 중 어떠한 컨피덴셜 컴퓨팅 프레임워크를 활용하는 것이 효과적인지에 대한 명확한 기준이 존재하지 않는다. 본 논문에서는 현존하는 상용 컨피덴셜 컴퓨팅 프레임워크 기술들의 특성에 대한 심층적인 비교 분석을 수행하고, 각 프레임워크의 장단점을 파악할 수 있는 기준 지표들을 도출한다. 이를 바탕으로, 설계 및 운용 목적에 따라 어떠한 프레임워크를 선택하여 활용하는 것이 효과적인지에 대한 선택 기준을 제안한다.
Abstract
Recently, Confidential computing plays an important role in next-generation cloud technology along with the development of trusted execution environments(TEEs), as it guarantees the trustworthiness of applications despite of untrusted nature of the cloud. Both academia and industry have actively proposed commercialized confidential computing solutions based on Intel SGX technology. However, the lack of clear criteria makes developers difficult to select a proper confidential computing framework among the possible options when implementing TEE-based cloud applications. In this paper, we derive baseline metrics that help to clarify the pros and cons of each framework through in-depth comparative analysis against existing confidential computing frameworks. Based on the comparison, we propose criteria to application developers for effectively selecting an appropriate confidential computing framework according to the design purpose of TEE-based applications.
참고문헌 (32)
- H. Li, "Learning IoT in Edge: Deep Learning for the Internet of Things with Edge Computing", IEEE Network, 32(1), pp.96~101 (2018)
- J.Han, "Toward scaling hardware security module for emerging cloud services", Proceedings of the 4th Workshop on System Software for Trusted Execution, pp.1~6 (2019)
- R. Mijumbi, "Network Function Virtualization: State-of-the-Art and Research Challenges", IEEE Communications Surveys & Tutorials, 18(1), pp.236~262 (2016)
- A. Baumann, "Shielding applications from an untrusted cloud with haven", Proceedings of the 11th USENIX Symposium on Operating Systems Design and Implementation, pp.267~283 (2014)
- A. J. Feldman, "SPORC : Group Collaboration using Untrusted Cloud Resources", Proceedings of the 9th USENIX Symposium on Operating Systems De-sign and Implementation, pp.337~350 (2010)
- F. McKeen, "Innovative Instructions and Software Model for Isolated Execution", Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Privacy, pp.1~1 (2013)
- J. M. McCune, "Flicker : an execution infrastructure for tcb minimization", Proceedings of the 3rd ACM SIGOPS, 2008, 315~328
- J. McCune, "TrustVisor: Efficient TCB reduction and attestation", Proceedings of the 2010 IEEE Symposium on Security and Privacy, pp.143~158 (2010)
- "Azure Confidential Computing"[URL]
- "Install SGX, Alibaba Cloud ECS"[URL]
- "Confidential Computing Consortium"[URL]
- C.C. Tsai, "Graphene-sgx: A practical library OS for unmodified applications on SGX", Proceedings of the 2017 USENIX Annual Technical Conference, pp.645~658 (2017)
- S. Arnautov, "SCONE: Secure linux containers with intel SGX", Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, pp.689~703 (2016)
- S. Shinde, "Panoply: Low-TCB Linux Applications With SGX Enclaves", Proceedings of the Network and Distributed System Security Symposium (2017)
- M. Orenbach, "Eleos: ExitLess OS services for SGX enclaves", Proceedings of the Twelfth European Conference on Computer Systems (2017)
- ARM, "Building a secure system using trustzone technology", PRD29-GENC-009492C, ~ (2008)
- D. KAPLAN, "AMD memory encryption" (2016), AMD Inc
- K. ASANOVIC, "Instruction sets should be free: The case for risc-v", UCB, 2014
- V. COSTAN, "Sanctum: Minimal hardware extensions for strong software isolation", Proceedings of the 25th USENIX Security Symposium (2016)
- Su-In Kang, "Improvemnet of Online Game Security using Intel SGX", Review of Korea Institute of Information Security and Cryptology, 27(4), pp.22~26 (2017)
- Dongyeob Kim, "Improvement of System Log Security using Intel SGX", Korea Software Congress, 45(2), pp.1085~1087 (2018)
- P. Jain, "OpenSGX: An open platform for SGX research", Proceedings of the Network and Distributed System Security Symposium (2016)
- "Intel Software Guard Extensions SDK"[URL]
- "Google Asylo"[URL]
- "Open Enclave SDK, Microsoft"[URL]
- N. D. Matsakis, "The rust language", Proceedings of the 2014 ACM SIGAda annual conference on High integrity language technology, pp.103~104 (2014)
- "Fortanix EDP"[URL]
- "Rust SGX SDK"[URL]
- "ENARX, Redhat"[URL]
- J.V. Bulck, "A tale of two worlds:Assessing the vulnerability of enclave shielding runtimes", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.1741~1758 (2019)
- S. Mofrad, "A comparison study of intel SGX and AMD memory encryption technology", Proceedings of the 7th International Workshop on Hardware and Architectural Support for Security and Privacy, pp.1~8 (2018)
- M. Pieter, "Hardware-based trusted computing architectures for isolation and attestation", IEEE Transactions on Computers, 67(3), pp.361~374 (2018)