Secure Outsourced Computation in a Multi-Tenant Cloud. Seny Kamara - Microsoft Research Mariana Raykova - Columbia

Transcription

1 Secure Outsurced Cmputatin in a Multi-Tenant Clud Seny Kamara - Micrsft Research Mariana Raykva - Clumbia

2 Outsurced Cmputatin (x, f ) f (x) IBM WCSC 2

3 The Clud IBM WCSC 3

4 Virtualized Servers App1 App2 App App OS OS Hypervisr Hardware OS IBM WCSC 4

5 Multi-Tenancy Virtualizatin enables multi-tenancy VMs frm different clients run n the same server Multi-tenancy allws clud peratr t Optimize resurces usage This all leads t $ saved fr clients App1 App2 App App OS Hypervisr Hardware OS OS IBM WCSC 5

6 Multi-Tenancy Multi-tenancy is indispensible t clud cmputing This is where part f the ecnmic incentives cme frm but it intrduces security cncerns What if a c-lcated VM attacks my VM? Current slutin is VM islatin VMs cannt see each ther s memry r state Resurces are apprpriately shared App1 App2 App OS OS Hypervisr Hardware IBM WCSC 6

7 Breaking Islatin Expliting the hypervisr Sme attacks knwn against VMware s ESX, XBOX s hypervisr, Bypassing the hypervisr [Ristenpart et al. 09] shw that crss VM side-channels are pssible Cnclusin frm [Ristenpart et al. 09]: If security is a cncern, use a single-tenant server. IBM WCSC 7

8 Hw d we Prtect vs. Multi-Tenancy? App1 App2 App OS OS Hypervisr Hardware VM Islatin vulnerabilities side-channels Cryptgraphy strng security Single-Tenancy Perfectly secure IBM WCSC 8

9 Outline Mtivatin Secure utsurced cmputatin in a multi-tenant clud Delegatin prtcls Security definitin in ideal/real wrld paradigm General-purpse delegatin prtcl Secret sharing & MPC Limitatins f ur apprach IBM WCSC 9

10 A Pssible Apprach (EncK(x), f ) EncK ( f (x) ) Verifiable cmputatin [Gentry-Gennar-Parn, Chung-Kalai-Vadhan] Fully-Hmmrphic Encryptin (xʼ, f ) [Gentry, ] f (x), π IBM WCSC 10

11 FHE + VC Efficiency FHE is nt practical VC is based n FHE Overkill Interactin is OK Clud is nt a single-server envirnment IBM WCSC 11

12 Delegatin Prtcl Prtcl between C: the client wh prvides an input VM 1,,VM w : VM wrkers wh have n input but return an utput X IBM WCSC 12

13 Underlying Assumptin Crss VM attacks always wrk Semi-hnest: if A c-lcates a VM then it recvers client VM s state Malicius: if A c-lcates a VM then it cntrls client VM Wrst-case assumptin Makes ur results strnger Captures cncerns f highly sensitive clients (e.g., gvernments) Nt essential t ur mdel prbability f successful crss VM attack can be taken int accunt IBM WCSC 13

14 Security Definitin Ideal/real wrld paradigm frm MPC [,Canetti01] Real executin: C and VMs run the real prtcl in presence f A that can c-lcate adversarial VMs Ideal executin: C sends input t trusted party wh returns f(x) in presence f A that can c-lcate adversarial VMs Security: every A in the real wrld can be emulated by an A in the ideal wrld Nte: If A is malicius then it is allwed t abrt during the executins Guarantees: As lng as A c-lcates at mst (w - 1) adversarial VMs Privacy: A learns n infrmatin abut C s input r utput Crrectness: C receives crrect utput IBM WCSC 14

15 Multi-Party Cmputatin x f (x,y,z) y 80 s: [Ya, Gldreich-Micali- Wigdersn, ] z Tday: [Mhassel-Franklin, Lindell- Pinkas, Klesnikv-Sadeghi- Schnedier, ] IBM WCSC 15

16 Secret Sharing [Shamir]? IBM WCSC 16

17 A General-Purpse Prtcl The apprach Split input x int w shares (s 1,,s n ) Stre each share in a separate VM Make the VMs evaluate F using MPC F(s 1,,s n ; r 1 r n ): recvers the input x frm the shares Evaluates y = f(x) Use r 1 r n t generate w shares f y Output a share f y t each VM VMs send back their shares t C wh recvers y IBM WCSC 17

18 Intuitin Secret sharing A must crrupt each wrker MPC Enables VMs t securely cmpute n shared input Withut revealing infrmatin abut shares t ther wrkers Prevents A frm learning abut 2+ shares with a single crruptin Cin Tssing Cins will be unifrm as lng as at least ne wrker is uncrrupted Guarantees sharing f utput is secure Delegatin is secure vs. malicius A if MPC is IBM WCSC 18

19 Limitatins f Delegatin Prtcls Efficiency Overhead fr recver & share Overhead fr MPC [+ ZKPs/C&C if A is malicius] Cst Requires an extra (n 1) VMs Useful if cst f prtcl < cst f single-tenant server Onging wrk Efficient delegatin prtcls fr specific functinalities (e.g., plynmials) Cmbining ur apprach with ther techniques IBM WCSC 19

20 Questins? IBM WCSC 20