Principles and practice of TEE replication (and beyond)

Overview

Abstract

Trusted Execution Environments (TEEs) ensure the confidentiality and integrity of computations in hardware. Subject to the TEE's threat model, the hardware shields a computation from most externally induced fault behavior except crashes. As a result, a crash-fault tolerant (CFT) replication protocol should be sufficient when replicating trusted code inside TEEs.  However, TEEs do not provide efficient and general means of ensuring the freshness of external, persistent state. Therefore, CFT replication is insufficient for TEE computations with external state, as this state could be rolled back to an earlier version when a TEE restarts.  Furthermore, using BFT protocols in this setting is too conservative, because these protocols are designed to tolerate arbitrary behavior, not just rollback during a restart.

In this talk, I will present the restart-rollback fault model for replicating TEEs, which precisely captures the possible fault behaviors of TEEs with external state. Then, I will show that existing replication protocols can be easily adapted to this fault model with few changes, while retaining their original performance. In particular, we adapted two widely used crash fault tolerant protocols--the Attiya, Bar-Noy, Dolev read/write register protocol and the Paxos consensus protocol--to the new fault model.  Furthermore, we leverage these protocols to build a replicated metadata service called TEEMS, and then show that it can add TEE-grade confidentiality, integrity, and freshness to untrusted cloud storage services. Finally, time permitting, I will preview our ongoing work that highlights the power and generality of this model by applying to conventional replicated storage systems, to address a pending tension between performance and durability guarantees.

Brief Biography

Rodrigo Rodrigues is a full professor at the Instituto Superior Tecnico (ULisboa) and a researcher at INESC-ID since 2015. Previously, he was a faculty at the Nova University of Lisbon, and before that, at the Max Planck Institute for Software Systems (MPI-SWS), where he led the Dependable Systems Group. He received his Ph.D. from the Massachusetts Institute of Technology (MIT) in 2005, under the supervision of Prof. Barbara Liskov. He has won several fellowships and awards, including a best paper award at the Symposium on Operating Systems Principles, the flagship conference in computer systems, a special recognition award from MIT's Department of Electrical Engineering and Computer Science, an ERC starting grant, and a Google faculty research award. He published and served on the program committee of the leading venues in the systems area, including SOSP, OSDI, NSDI, and as program co-chair of EuroSys. He has graduated a total of six Ph.D. students as a main advisor, who have taken on tenure-track and tenured faculty positions in leading academic institutions such as Purdue, Univ. Edinburgh, TU Munich, or USTC in China. His service record includes serving as co-director of the Carnegie Mellon-Portugal program, the research axis of the Portuguese National Digital Skills Initiative e.2030, and, more recently, as President of the Scientific Council of Instituto Superior Técnico.