Autocrypt

Abstract

Web servers are vulnerable to a large class of attacks which can allow network attacker to steal sensitive web content. In this work, we investigate the feasibility of a web server architecture, wherein the vulnerable server VM runs on a trusted cloud. All sensitive web content is made available to the vulnerable server VM in encrypted form, thereby limiting the effectiveness of data-stealing attacks through server VM compromise.In this context, the main challenge is to allow the legitimate functionality of the untrusted server VM to work. As a step towards this goal, we develop a tool called AUTOCRYPT, which transforms a subset of existing C functionality in the web stack to operate on encrypted sensitive content. We show that such a transformation is feasible for several standard Unix utilities available in a typical LAMP stack, with no developer effort. Key to achieving this expressiveness over encrypted data, is our scheme to combine and convert between partially-homomorphic encryption (PHE) schemes using a small TCB in the trusted cloud hypervisor. We show that x86 code transformed with AUTOCRYPT achieves performance that is significantly better than its alternatives (downloading to a trusted client, or using fully-homomorphic encryption).

Keystone: An Open Framework for Architecting TEEs

“…They comprise 15.7 and 15.4KLoC of TH [13] and THNN [16] libraries from Torch compiled with musl libc. Each model has an additional 230 to 13.4 KLoC of model-specific inference code [133]. We performed two sets of experiments: (a) execute the model inference code with static maximum enclave size; (b) turn on the dynamic resizing plugin so that the enclave extends its size on-demand when it executes.…”

“…All major CPU vendors have rolled out their TEEs (e.g., ARM TrustZone, Intel SGX, and AMD SEV) to create a secure execution environment, commonly referred to as an enclave [24,79,96]. On the consumer end, TEEs are now being used for secure cloud services [25,31], databases [115], big data computations [37,59,121], secure banking [91], blockchain consensus protocols [9,92,98], smart contracts [32,49,141], machine learning [106,133], network middleboxes [67,68], and so on. These use-cases have diverse deployment environments ranging from cloud servers, client devices, mobile phones, ISPs, IoT devices, sensors, and hardware tokens.…”