Uranus

Abstract

Applications written in Java have strengths to tackle diverse threats in public clouds, but these applications are still prone to privileged attacks when processing plaintext data. Intel SGX is powerful to tackle these attacks, and traditional SGX systems rewrite a Java application's sensitive functions, which process plaintext data, using C/C++ SGX API. Although this code-rewrite approach achieves good efficiency and a small TCB, it requires SGX expert knowledge and can be tedious and error-prone. To tackle the limitations of rewriting Java to C/C++, recent SGX systems propose a code-reuse approach, which runs a default JVM in an SGX enclave to execute the sensitive Java functions. However, both recent study and this paper find that running a default JVM in enclaves incurs two major vulnerabilities, Iago attacks, and control flow leakage of sensitive functions, due to the usage of OS features in JVM. In this paper, Uranus creates easy-to-use Java programming abstractions for application developers to annotate sensitive functions, and Uranus automatically runs these functions in SGX at runtime. Uranus effectively tackles the two major vulnerabilities in the code-reuse approach by presenting two new protocols: 1) a Java bytecode attestation protocol for dynamically loaded functions; and 2) an OS-decoupled, efficient GC protocol optimized for data-handling applications running in enclaves. We implemented Uranus in Linux and applied it to two diverse data-handling applications: Spark and ZooKeeper. Evaluation shows that: 1) Uranus achieves the same security guarantees as two relevant SGX systems for these two applications with only a few annotations; 2) Uranus has reasonable performance overhead compared to the native, insecure applications; and 3) Uranus defends against privileged attacks. Uranus source code and evaluation results are released on https://github.com/hku-systems/uranus. CCS CONCEPTS • Security and privacy → Software security engineering.

SecV

“…Several tools have been proposed to partition code written in specific languages for enclaves. Glamdring [23] provides a technique to automatically partition C applications, while Montsalvat [66], Civet [57], and Uranus [18] propose solutions to partition Java applications for Intel SGX enclaves. Among those partitioning systems, none provide a language-independent way to partition enclave programs.…”

“…Unfortunately, partitioning tools only exist for a few languages: Java with Civet [57], Montsalvat [66] and Uranus [18], Go with GOTEE [14], and C with Glamdring [23]. These tools depend heavily on the language semantics and cannot be reused for other languages.…”

Montsalvat

“…Several tools have been proposed to partition code written in specific languages for enclaves. Glamdring [23] provides a technique to automatically partition C applications, while Montsalvat [66], Civet [57], and Uranus [18] propose solutions to partition Java applications for Intel SGX enclaves. Among those partitioning systems, none provide a languageindependent way to partition enclave programs.…”

“…Since manually partitioning a large code base is complex and error-prone, several middleware technologies have been developed which permit developers to automatically partition their code prior to deployment in the cloud. Unfortunately, partitioning tools only exist for a few languages: Java with Civet [57], Montsalvat [66] and Uranus [18], Go with GOTEE [14], and C with Glamdring [23]. These tools depend heavily on the language semantics and cannot be reused for other languages.…”

“…While this approach is relatively straightforward to use for developers, it increases the chance of introducing security vulnerabilities into the enclave (due to the large TCB). Some language-specific alternatives [18,23,57,66] have been proposed recently to partition programs and keep only sensitive code and data within enclaves.…”