Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Road to Trust: Building Enclaves within Confidential VMs

Wenhao Wang, Linke Song, Benshan Mei, Shuang Liu, Shijun Zhao, Shoumeng Yan, XiaoFeng Wang, Dan Meng, Rui Hou

TL;DR

NestedSGX is introduced, a framework which leverages virtual machine privilege level (VMPL), a recent hardware feature available on AMD SEV-SNP to enable the creation of hardware enclaves within the guest VM, and considers the guest OS untrusted for loading potentially malicious code.

Abstract

Integrity is critical for maintaining system security, as it ensures that only genuine software is loaded onto a machine. Although confidential virtual machines (CVMs) function within isolated environments separate from the host, it is important to recognize that users still encounter challenges in maintaining control over the integrity of the code running within the trusted execution environments (TEEs). The presence of a sophisticated operating system (OS) raises the possibility of dynamically creating and executing any code, making user applications within TEEs vulnerable to interference or tampering if the guest OS is compromised. To address this issue, this paper introduces NestedSGX, a framework which leverages virtual machine privilege level (VMPL), a recent hardware feature available on AMD SEV-SNP to enable the creation of hardware enclaves within the guest VM. Similar to Intel SGX, NestedSGX considers the guest OS untrusted for loading potentially malicious code. It ensures that only trusted and measured code executed within the enclave can be remotely attested. To seamlessly protect existing applications, NestedSGX aims for compatibility with Intel SGX by simulating SGX leaf functions. We have also ported the SGX SDK and the Occlum library OS to NestedSGX, enabling the use of existing SGX toolchains and applications in the system. Performance evaluations show that context switches in NestedSGX take about 32,000 -- 34,000 cycles, approximately $1.9\times$ -- $2.1\times$ higher than that of Intel SGX. NestedSGX incurs minimal overhead in most real-world applications, with an average overhead below 2% for computation and memory intensive workloads and below 15.68% for I/O intensive workloads.

The Road to Trust: Building Enclaves within Confidential VMs

TL;DR

NestedSGX is introduced, a framework which leverages virtual machine privilege level (VMPL), a recent hardware feature available on AMD SEV-SNP to enable the creation of hardware enclaves within the guest VM, and considers the guest OS untrusted for loading potentially malicious code.

Abstract

Integrity is critical for maintaining system security, as it ensures that only genuine software is loaded onto a machine. Although confidential virtual machines (CVMs) function within isolated environments separate from the host, it is important to recognize that users still encounter challenges in maintaining control over the integrity of the code running within the trusted execution environments (TEEs). The presence of a sophisticated operating system (OS) raises the possibility of dynamically creating and executing any code, making user applications within TEEs vulnerable to interference or tampering if the guest OS is compromised. To address this issue, this paper introduces NestedSGX, a framework which leverages virtual machine privilege level (VMPL), a recent hardware feature available on AMD SEV-SNP to enable the creation of hardware enclaves within the guest VM. Similar to Intel SGX, NestedSGX considers the guest OS untrusted for loading potentially malicious code. It ensures that only trusted and measured code executed within the enclave can be remotely attested. To seamlessly protect existing applications, NestedSGX aims for compatibility with Intel SGX by simulating SGX leaf functions. We have also ported the SGX SDK and the Occlum library OS to NestedSGX, enabling the use of existing SGX toolchains and applications in the system. Performance evaluations show that context switches in NestedSGX take about 32,000 -- 34,000 cycles, approximately -- higher than that of Intel SGX. NestedSGX incurs minimal overhead in most real-world applications, with an average overhead below 2% for computation and memory intensive workloads and below 15.68% for I/O intensive workloads.
Paper Structure (23 sections, 7 figures, 5 tables)

This paper contains 23 sections, 7 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Intel SGX
  4. SEV-SNP and VMPL
  5. Threat model
  6. Design
  7. Overview
  8. Enclave life cycle management
  9. Memory isolation
  10. Measurement, attestation and sealing
  11. Implementations
  12. Security Analysis
  13. Evaluations
  14. Experimental setup
  15. Micro-benchmarks
  16. ...and 8 more sections

Figures (7)

  • Figure 1: Comparison between NestedSGX and other TEEs. NestedSGX offers a layered protection mechanism against both the host VMM and the guest OS within the CVM.
  • Figure 2: NestedSGX overview. The security monitor, the SGX emulation layer and the enclave operate in the kernel and user mode at VMPL0, while the guest OS and App operate in the kernel and user mode at VMPL1. The transitions between VMPL0 and VMPL1 occur via the untrusted host.
  • Figure 3: The management of enclave life cycles, e.g., handling synchronous and asynchronous enclave entry and exit events.
  • Figure 4: The guest physical address space is divided into 3 parts: the secure memory used by the security monitor, the EPC memory, and the normal memory.
  • Figure 5: The NestedSGX attestation report consists of two parts: the SEV-SNP attestation report signed by VCEK, and the enclave report signed by NestedSGX AIK. The NestedSGX AIK is generated within the security monitor and subsequently bound to the SEV-SNP hardware by placing its public key as part of the SEV-SNP attestation report.
  • ...and 2 more figures