Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

TEEMATE: Fast and Efficient Confidential Container using Shared Enclave

Chulmin Lee, Jaewon Hur, Sangho Lee, Byoungyoung Lee

TL;DR

TeeMate is introduced, a new approach to utilize the enclaves on the host system that achieves at least 4.5 times lower latency and 2.8 times lower memory usage compared to the applications built on the conventional confidential containers.

Abstract

Confidential container is becoming increasingly popular as it meets both needs for efficient resource management by cloud providers, and data protection by cloud users. Specifically, confidential containers integrate the container and the enclave, aiming to inherit the design-wise advantages of both (i.e., resource management and data protection). However, current confidential containers suffer from large performance overheads caused by i) a larger startup latency due to the enclave creation, and ii) a larger memory footprint due to the non-shareable characteristics of enclave memory. This paper explores a design conundrum of confidential container, examining why the confidential containers impose such large performance overheads. Surprisingly, we found there is a universal misconception that an enclave can only be used by a single (containerized) process that created it. However, an enclave can be shared across multiple processes, because an enclave is merely a set of physical resources while the process is an abstraction constructed by the host kernel. To this end, we introduce TeeMate, a new approach to utilize the enclaves on the host system. Especially, TeeMate designs the primitives to i) share the enclave memory between processes, thus preserving memory abstraction, and ii) assign the threads in enclave between processes, thus preserving thread abstraction. We concretized TeeMate on Intel SGX, and implemented confidential serverless computing and confidential database on top of TeeMate based confidential containers. The evaluation clearly demonstrated the strong practical impact of TeeMate by achieving at least 4.5 times lower latency and 2.8 times lower memory usage compared to the applications built on the conventional confidential containers.

TEEMATE: Fast and Efficient Confidential Container using Shared Enclave

TL;DR

TeeMate is introduced, a new approach to utilize the enclaves on the host system that achieves at least 4.5 times lower latency and 2.8 times lower memory usage compared to the applications built on the conventional confidential containers.

Abstract

Confidential container is becoming increasingly popular as it meets both needs for efficient resource management by cloud providers, and data protection by cloud users. Specifically, confidential containers integrate the container and the enclave, aiming to inherit the design-wise advantages of both (i.e., resource management and data protection). However, current confidential containers suffer from large performance overheads caused by i) a larger startup latency due to the enclave creation, and ii) a larger memory footprint due to the non-shareable characteristics of enclave memory. This paper explores a design conundrum of confidential container, examining why the confidential containers impose such large performance overheads. Surprisingly, we found there is a universal misconception that an enclave can only be used by a single (containerized) process that created it. However, an enclave can be shared across multiple processes, because an enclave is merely a set of physical resources while the process is an abstraction constructed by the host kernel. To this end, we introduce TeeMate, a new approach to utilize the enclaves on the host system. Especially, TeeMate designs the primitives to i) share the enclave memory between processes, thus preserving memory abstraction, and ii) assign the threads in enclave between processes, thus preserving thread abstraction. We concretized TeeMate on Intel SGX, and implemented confidential serverless computing and confidential database on top of TeeMate based confidential containers. The evaluation clearly demonstrated the strong practical impact of TeeMate by achieving at least 4.5 times lower latency and 2.8 times lower memory usage compared to the applications built on the conventional confidential containers.

Paper Structure

This paper contains 32 sections, 12 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Container based Resource Management
  4. Enclave based Data Protection
  5. Confidential Container: Intersection of Container and Enclave
  6. Infeasibility of Confidential Container
  7. Preliminary Experiments on the Performance Overheads
  8. Limitations of Previous Works to Solve the Performance Overheads
  9. Key Idea of TeeMate
  10. Universal Assumption: One-to-One Enforcement of Process and Enclave
  11. Our Solution: Sharing a Single Enclave across Multiple Containers
  12. Design of TeeMate
  13. Threat Model
  14. Design Overview
  15. Sharing Enclave Memory across Multiple Containers
  16. ...and 17 more sections

Figures (12)

  • Figure 1: Performance comparison of confidential serverless computing versus the native model. : [0.5]Native Serverless, : [0.5]Confidential Serverless. The bloated memory of confidential serverless computing is due to the Gramine LibOS's implementation that physically populates all the allocated virtual memory tsai2017graphene.
  • Figure 2: Performance comparison of confidential database system versus the native system.
  • Figure 3: Relation between an enclave and process in the perspective of host kernel.
  • Figure 4: Threat model of TeeMate.
  • Figure 5: Sharing the same EPC pages across different containers using EPC aliasing
  • ...and 7 more figures