VC3: Trustworthy Data Analytics in the Cloud Using SGX
Félix Schustera b c, Manuel Costad, Cédric Fournet Ad, Christos Gkantsidisd, Marcus Peinadod, Gloria Mainar-Ruizd, Mark Russinovichd
- aWork done while at Microsoft Research; affiliated with Horst Görtz Institut (HGI) at Ruhr-Universität, Bochum, Germany
- bWork done while at Microsoft Research
- caffiliated with Horst Görtz Institut (HGI) at Ruhr-Universität, Bochum, Germany
- dMicrosoft Research
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
We present VC3, the first system that allows users to run distributed MapReduce computations in the cloud while keeping their code and data secret, and ensuring the correctness and completeness of their results. VC3 runs on unmodified Hadoop, but crucially keeps Hadoop, the operating system and the hyper visor out of the TCB, thus, confidentiality and integrity are preserved even if these large components are compromised. VC3 relies on SGX processors to isolate memory regions on individual computers, and to deploy new protocols that secure distributed MapReduce computations. VC3 optionally enforces region self-integrity invariants for all MapReduce code running within isolated regions, to prevent attacks due to unsafe memory reads and writes. Experimental results on common benchmarks show that VC3 performs well compared with unprotected Hadoop: VC3's average runtime overhead is negligible for its base security guarantees, 4.5% with write integrity and 8% with read/write integrity.