Freecursive ORAM

Abstract

Oblivious RAM (ORAM) is a cryptographic primitive that hides memory access patterns as seen by untrusted storage. Recently, ORAM has been architected into secure processors. A big challenge for hardware ORAM schemes is how to efficiently manage the Position Map (PosMap), a central component in modern ORAM algorithms. Implemented naïvely, the PosMap causes ORAM to be fundamentally unscalable in terms of on-chip area. On the other hand, a technique called Recursive ORAM fixes the area problem yet significantly increases ORAM's performance overhead.To address this challenge, we propose three new mechanisms. We propose a new ORAM structure called the PosMap Lookaside Buffer (PLB) and PosMap compression techniques to reduce the performance overhead from Recursive ORAM empirically (the latter also improves the construction asymptotically). Through simulation, we show that these techniques reduce the memory bandwidth overhead needed to support recursion by 95%, reduce overall ORAM bandwidth by 37% and improve overall SPEC benchmark performance by 1.27×. We then show how our PosMap compression techniques further facilitate an extremely efficient integrity verification scheme for ORAM which we call PosMap MAC (PMMAC). For a practical parameterization, PMMAC reduces the amount of hashing needed for integrity checking by ≥ 68× relative to prior schemes and introduces only 7% performance overhead.We prototype our mechanisms in hardware and report area and clock frequency for a complete ORAM design postsynthesis and post-layout using an ASIC flow in a 32 nm commercial process. With 2 DRAM channels, the design post-layout runs at 1 GHz and has a total area of .47 mm 2 . Depending on PLB-specific parameters, the PLB accounts for 10% to 26% area. PMMAC costs 12% of total design area. Our work is the first to prototype Recursive ORAM or ORAM with any integrity scheme in hardware.

Locality Aware Path ORAM: Implementation, Experimentation and Analytical Modeling

“…Fletcher et al [34] developed three techniques to improve the performance of any recursive ORAM. Their work is an enhancement to the work of Ren et al [33].…”

InvisiMem

“…Table 1 compares various leaks through memory bus side channel and cold boot attack that secure processors must protect. It describes the solutions used in two of the recent ORAM-based work, Freecursive ORAM [21] and Ghostrider [36]. While more recent ORAMbased work exists [61], we consider Freecursive ORAM [21] as it proposes a ORAM-based defense optimized for providing data integrity and freshness guarantees as well.…”

“…To obfuscate the address pattern, depending on the memory size, an ORAM access may require one to two orders of more memory accesses compared to a normal DRAM access. Recent hardware innovations such as Freecursive ORAM have made significant improvements to bring down the performance cost to about 4X [21], though at a significant increase in hardware complexity, on-chip (80KB) and off-chip (more than 2X) space overhead.…”

“…Replay attacks can be prevented by including a version number during the HMAC creation. The processor must securely track the current version of the memory state [21,58], and use it to check if a read is returning the latest version. But these data integrity checks incur additional performance and space overhead, and complexity.…”

“…To do so, it issues several memory accesses for every normal access. In spite of significant recent advancements [21,61] such ORAM-based solutions increase memory access latency considerably (~20X) and incur huge performance . ORAM also has security limitations in that it does not help guard against memory timing channel [36].…”