PraaS: Verifiable Proofs ofProperty as-a-Service withIntel SGX
Istemi Ekin Akkus, Ivica Rimac, Ruichuan
Chen08.07.2024
7th Workshop on System Software for
Trusted Execution (SysTEX 2024)
1© 2024 Nokia

The future is full of datasets2© 2024 Nokia

The future is an Industry 4.0 ecosystem
Ecosystem formonetization of datasets

Dataset Owner3© 2024 Nokia

DatasetDatasetDataset User

The future is full of software supply chain attacks

Colonial
Pipeline

CVE-2024-3094
Severity: 10.04© 2024 Nokia

Motivation for an Industry 4.0 EcosystemEcosystem formonetization of datasets

Dataset Owner

Dataset1. Wants to advertiseproperties of their assets
effectively
2. Wants to protect theconfidentiality of theirassets
5© 2024 Nokia

DatasetDataset User

Wants to check properties of
the assets before buying• Statistics, formatting, provenance,internal consistency, privacy,
copyrighted material, ...

Additional Requirements & Goal
Utility isapplicationdependent

Datasets are often
large

Datasets can bestreaming

Monetization isimportant➢ Customizability➢ On-demandcomputation➢ Scalability➢ Low latency➢ Low costWhat is the minimum cost and trust to obtain the maximum performance?
- Without violating confidentiality of datasets and not breaking other requirements

6© 2024 Nokia

Goal & Idea
Provide 3rd party verifiable proofs about datasetswithhigh scalability, low latency, low cost and “acceptable trust”
while
preserving confidentiality of datasets

Trusted Execution Environments (TEEs) inpublic clouds7© 2024 Nokia

Agenda- Motivation- Background & Assumptions-

SGX Remote Attestation-Threat Model and Assumptions- PraaS Overview- Evaluation

8© 2024 Nokia

SGX Remote Attestation
Ensuring the intended enclave is running
When initiated, an enclave produces anattestation report/quote containing:➢ Cryptographic hash of code and data(MRENCLAVE)➢ A signature via the attestation key of thehardware
Local attestation: between two enclaves on
the same platform
Remote attestation: between a client andan enclave➢ Increased confidence that the intended
software is running in an SGX enclavewith latest TCB version

9© 2024 Nokia

Remote attestation
User Platform

1. Challenge (nonce)

User Application
Enclave
2. REPORTQuotingEnclave
Platform Software

Challenger (Client)
4. Response (QUOTE)

3. QUOTE

5. QUOTE
Verification

Attestation Service

Actors, Threat Model and Assumptions
ActorsThreat Model & Assumptions❖ Dataset Owner: Wants to prove to others that a❖ No collusion between PraaS/cloud

confidential dataset satisfies certain properties
without exposing it to others❖ Dataset User: Wants to obtain guarantees about

datasets before purchasing and using them intheir application❖ PraaS Provider: Operates the necessary software

infrastructure in a cloud setting

provider and dataset owner/user❖ No attacks on TEEs

❖ Instantiation with Intel SGX❖ Cloud Provider: Provides hardware infrastructurewith standard security practices and up-to-dateTEEs

10© 2024 Nokia❖ Supplementary protocols not in scope

Agenda- Motivation- Background & Assumptions- PraaS Overview-

Enclave-signed output-

Property Computation Functions (PCFs)- Prototype Implementation and Evaluation11© 2024 Nokia

Proof Generation

7. Check
attestation quote

Strawman
Attestation Service
SGX-PraaS Strawman
Trusted CodeUntrusted
Service Code

1B. Initialize andreturn report

1A. Accept
request andcreate enclave
2. Pass quote
4A. Passencrypted data

4B. Receive anddecrypt data
4C. Compute overdata
5A. Return output

12© 2024 Nokia

2. Receive
attestation quote
4. Send encrypted
data & trigger
computation

5. Receive output
5B. Pass output

TEE

1. Initiate SGX
enclave

3. Check
attestation
quote

6. Send quote &output

Does not work!
Attestation result and SGX
output are not linked
together!

7. Checkattestation quotewith public key

Enclave-signed Output
Linking attestation with computation
Attestation ServiceSGX-PraaS
Trusted Code
1B. Initialize,
generate anephemeralpublic/private
keypair and return
report with publickey

Untrusted
Service Code
1A. Accept
request andcreate enclave
2. Pass quotewith public key
4A. Passencrypted data

4B. Receive anddecrypt data

4C. Compute overdata
5A. Sign output
and return it
TEE13© 2024 Nokia

5B. Pass signed
output1. Initiate SGX
enclave

3. Checkattestation
quote withpublic key

2. Receive
attestation quotewith public key
4. Send encrypted
data & trigger
computation
5. Receive signedoutput

6. Send attestation
quote with public key& signed output tothird parties

Verifiable Proof of Property:
Attestation quote with enclave public key+ signed output

8. Check output
signature withpublic key from
attestation quote

Property Computation Functions (PCFs)•Extract a desired property from a dataset-•

Envisioned as a catalogue of useful functions to bepicked from-•

14

Statistical properties, formatting, internal consistency, anonymization,
existence of PII/copyrighted material, …

Examples: sampling, non-repetition + sampling, statistics, sampling +statistics, …

Available to both dataset owners and potential dataset
users-

Dataset owners inspect to check if it is leaking confidential data-

Dataset users inspect to verify it is computing the desired property-

Both can reject if not satisfied© 2024 Nokia

Enclave Templates➢ Most of enclave code is generic➢ Build scripts, declarations, common libraries➢ Several common steps for Proof-of-Property➢ Initialization with ephemeral public/private keypair,

Enclave
template

receiving encrypted data, signing output

Property Computation Function = Enclave template + custom property logicFaster development15© 2024 Nokia

Easiercustomization

Easierreproducibility

Architecture Details

System code(Untrusted) Service code

SGX-PraaS
Trusted Code
1B. Initialize,generate anephemeral
public/private
keypair and return
report with publickey

Untrusted
Service Code• Attestation result check• Signature check2. Pass quotewith public key

4C. Compute overdata
5A. Sign output
and return it
TEE© 2024 Nokia

Client code

1A. Accept
request andcreate enclave

Enclave code for Proof-of-Property
computation

4A. Passencrypted data

4B. Receive anddecrypt data

16• Enclave initialization (1A)
• Proxying encrypted data between client andenclave (2, 4A, 5B)

5B. Pass signed
outputEnclave
template• General steps: pub/private keypair
generation (1B), data decryption (4B), output
signing(5A)• Custom step: property extraction (4C)

User-provided code

Agenda- Motivation- Background & Assumptions- PraaS Overview- Prototype Implementation and Evaluation

17-

Common operations-

Static datasets with sampling-Streaming datasets with statistics© 2024 Nokia

PrototypeImplementation and evaluation setup
C/C++ implementation

Python implementation (with gramine libOS)•

Service code (<1K + JSON library)•

Service code with <600 lines of code•

Enclave templates (~1K lines of code)•

Python client with ~400 lines of code•

Python client (~500 lines of code)•

4 PCFs each with ~45 lines of custom code•

4 PCFs each with ~100-225 lines of custom code

Evaluation•

Sampling for static datasets (up to 5M hashes)•

Statistics for streaming data (up to 200K integers/second)

Setup
•

Azure Confidential Computing instance DC2sv3 (2vCPUs and 16GB RAM)

•With Microsoft Attestation Service➢

Cost: ~0.16 Euro/hour

18© 2024 Nokia

Common Operations
Across enclave types and dataset sizes (milliseconds), 20+ runs
Setting up the enclave at the server••

Initiating the enclave, obtaining the attestation
report, getting a quote, …

Verification of the quote at the client••

Contacting the Attestation Service Provider withthe quote➢Independent ofthe dataset size19

© 2024 Nokia

Enclave setup

Quoteverification

Sampling~1800 ms

~175 ms

Nonrep. +Sampling~1844 ms

~174 ms

Statistics~424 ms~183 ms

Sampling +Statistics~443 ms~184 ms➢Depends on theenclave config➢Sampling: Heap 256K
pages, Stack 8K➢(More or less)constant timeSampling for Static Datasets
Client-side latencies (seconds), 20+ runs
1M

2M

3M

4M

5M

Encryption of dataset~6.2 s~ 12.4 s~18.7 s~24.9 s~31.2 sTransmission & waiting
for result~47.1 s~94.0 s~141.3 s~188.3 s~235.5 s

Property computation(Server-side)~0.03 s~0.05 s~0.08 s~0.11 s~0.14 sSignature on result(Server-side)~0.02 s~0.04 s~0.05 s~0.07 s~0.09 sSignature verification~0.07 s~0.14 s~0.20 s~0.27 s~0.35 sTotal~53.4 s~106.7 s~160.3 s~213.6 s~267.1 s20© 2024 Nokia

1 hash = 65B- SHA256- 0x16 encoding- "\n"

5M hashes ~=310 MB

Statistics for Streaming Datasets
Client-side latency (milliseconds), 20+ runs, 100 batches-Broker sends to subscribers only the batcheswith certain statistics to reduce bandwidth-

Subscribers want assurance the broker is filteringcorrectly➢ Near real-timelatency
50K/sec

100K/sec

150K/sec

200K/sec

Prooflatency~211 ms~411 ms~620 ms~813 ms

Batch size

195KB

390KB

585KB

780KB

Proof size

<1KB

<1KB

<1KB

<1KB➢

21

© 2024 Nokia

Bandwidthreduction

vsSummary & Open Issues
SummaryPraaS: Verifiable proofs of dataset properties using Intel SGX➢ Enable increased interaction among dataset owners and potential users without trust relations➢ High performance and low latency for static and streaming datasets with low cost
➢ Easy customizability with enclave templates for C/C++ and python➢ Source code available: https://github.com/Nokia-Bell-Labs/proof-as-a-service

Open issues❑ Leakage of sensitive information if only interested in the property❑

Differential privacy❑ Inspection of property computation logic may not catch covert channels that require collusion
22© 2024 Nokia