UniGuard: Protecting Unikernels Using Intel SGX.

Ioannis Sfyrakis; Thomas Gross

doi:10.1109/IC2E.2018.00032

UniGuard: Protecting Unikernels Using Intel SGX.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Computations executed in lightweight virtual machines called unikernels have a minimal attack surface and improved performance. However, unikernels are still prone to leaking information to the operating system or to the hypervisor that hosts them. This is attributed to vulnerabilities in privileged software and to malicious insiders operating in cloud infrastructures. Indeed, the deployment of unikernels requires a protection mechanism to ensure that information does not leak from unikernels. In this paper, we present our initial experiments into the use of an approach to creating a Trusted Execution Environment (TEE) in unikernels. We present UniGuard: a security architecture that leverages Intel Software Guard Extensions (SGX) to protect security-sensitive computations inside unikernels. We believe that unikernels are an excellent match for Intel SGX to create a TEE. We implemented our solution on top of the KVM hypervisor and its Intel SGX support. Results show that UniGuard has a comparable 20% overhead when starting an enclave inside a unikernel and 10% when executing ocalls.

Original language	English
Title of host publication	Proceedings 2018 IEEE International Conference on Cloud Engineering
Publisher	IEEE
Pages	99-105
Number of pages	6
DOIs	https://doi.org/10.1109/IC2E.2018.00032
Publication status	Published - 17 Apr 2018
Externally published	Yes
Event	2018 IEEE International Conference on Cloud Engineering - Orlando, United States Duration: 17 Apr 2018 → 20 Apr 2018 https://www.computer.org/csdl/proceedings/ic2e/2018/12OmNqEjhZg

Conference

Conference	2018 IEEE International Conference on Cloud Engineering
Abbreviated title	IC2E 2018
Country/Territory	United States
City	Orlando
Period	17/04/18 → 20/04/18
Internet address	https://www.computer.org/csdl/proceedings/ic2e/2018/12OmNqEjhZg

Bibliographical note

DBLP's bibliographic metadata records provided through http://dblp.org/search/publ/api are distributed under a Creative Commons CC0 1.0 Universal Public Domain Dedication. Although the bibliographic metadata records are provided consistent with CC0 1.0 Dedication, the content described by the metadata records is not. Content may be subject to copyright, rights of privacy, rights of publicity and other restrictions.

Access to Document

10.1109/IC2E.2018.00032Licence: Unspecified

https://dblp.org/rec/conf/ic2e/SfyrakisG18

PRISMACLOUD PRIvacy & Security MAintaining Services in the CLOUD
Gross, T. (CoI) & Sfyrakis, I. (RA)
2/02/15 → 31/07/18
Project: Research

Cite this

@inproceedings{b988b5e4232b4f8b90216be633c39b27,

title = "UniGuard: Protecting Unikernels Using Intel SGX.",

abstract = "Computations executed in lightweight virtual machines called unikernels have a minimal attack surface and improved performance. However, unikernels are still prone to leaking information to the operating system or to the hypervisor that hosts them. This is attributed to vulnerabilities in privileged software and to malicious insiders operating in cloud infrastructures. Indeed, the deployment of unikernels requires a protection mechanism to ensure that information does not leak from unikernels. In this paper, we present our initial experiments into the use of an approach to creating a Trusted Execution Environment (TEE) in unikernels. We present UniGuard: a security architecture that leverages Intel Software Guard Extensions (SGX) to protect security-sensitive computations inside unikernels. We believe that unikernels are an excellent match for Intel SGX to create a TEE. We implemented our solution on top of the KVM hypervisor and its Intel SGX support. Results show that UniGuard has a comparable 20% overhead when starting an enclave inside a unikernel and 10% when executing ocalls.",

author = "Ioannis Sfyrakis and Thomas Gross",

note = "DBLP's bibliographic metadata records provided through http://dblp.org/search/publ/api are distributed under a Creative Commons CC0 1.0 Universal Public Domain Dedication. Although the bibliographic metadata records are provided consistent with CC0 1.0 Dedication, the content described by the metadata records is not. Content may be subject to copyright, rights of privacy, rights of publicity and other restrictions.; 2018 IEEE International Conference on Cloud Engineering , IC2E 2018 ; Conference date: 17-04-2018 Through 20-04-2018",

year = "2018",

month = apr,

day = "17",

doi = "10.1109/IC2E.2018.00032",

language = "English",

pages = "99--105",

booktitle = "Proceedings 2018 IEEE International Conference on Cloud Engineering",

publisher = "IEEE",

url = "https://www.computer.org/csdl/proceedings/ic2e/2018/12OmNqEjhZg",

}

TY - GEN

T1 - UniGuard

T2 - 2018 IEEE International Conference on Cloud Engineering

AU - Sfyrakis, Ioannis

AU - Gross, Thomas

N1 - DBLP's bibliographic metadata records provided through http://dblp.org/search/publ/api are distributed under a Creative Commons CC0 1.0 Universal Public Domain Dedication. Although the bibliographic metadata records are provided consistent with CC0 1.0 Dedication, the content described by the metadata records is not. Content may be subject to copyright, rights of privacy, rights of publicity and other restrictions.

PY - 2018/4/17

Y1 - 2018/4/17

N2 - Computations executed in lightweight virtual machines called unikernels have a minimal attack surface and improved performance. However, unikernels are still prone to leaking information to the operating system or to the hypervisor that hosts them. This is attributed to vulnerabilities in privileged software and to malicious insiders operating in cloud infrastructures. Indeed, the deployment of unikernels requires a protection mechanism to ensure that information does not leak from unikernels. In this paper, we present our initial experiments into the use of an approach to creating a Trusted Execution Environment (TEE) in unikernels. We present UniGuard: a security architecture that leverages Intel Software Guard Extensions (SGX) to protect security-sensitive computations inside unikernels. We believe that unikernels are an excellent match for Intel SGX to create a TEE. We implemented our solution on top of the KVM hypervisor and its Intel SGX support. Results show that UniGuard has a comparable 20% overhead when starting an enclave inside a unikernel and 10% when executing ocalls.

AB - Computations executed in lightweight virtual machines called unikernels have a minimal attack surface and improved performance. However, unikernels are still prone to leaking information to the operating system or to the hypervisor that hosts them. This is attributed to vulnerabilities in privileged software and to malicious insiders operating in cloud infrastructures. Indeed, the deployment of unikernels requires a protection mechanism to ensure that information does not leak from unikernels. In this paper, we present our initial experiments into the use of an approach to creating a Trusted Execution Environment (TEE) in unikernels. We present UniGuard: a security architecture that leverages Intel Software Guard Extensions (SGX) to protect security-sensitive computations inside unikernels. We believe that unikernels are an excellent match for Intel SGX to create a TEE. We implemented our solution on top of the KVM hypervisor and its Intel SGX support. Results show that UniGuard has a comparable 20% overhead when starting an enclave inside a unikernel and 10% when executing ocalls.

U2 - 10.1109/IC2E.2018.00032

DO - 10.1109/IC2E.2018.00032

M3 - Conference contribution

SP - 99

EP - 105

BT - Proceedings 2018 IEEE International Conference on Cloud Engineering

PB - IEEE

Y2 - 17 April 2018 through 20 April 2018

ER -

UniGuard: Protecting Unikernels Using Intel SGX.

Abstract

Conference

Bibliographical note

Access to Document

Fingerprint

Projects

PRISMACLOUD PRIvacy & Security MAintaining Services in the CLOUD

Cite this