Revisiting Rollbacks on Smart Contracts inTEE-protected Private Blockchains
Systex 2024 workshop

Chen Chang Lew, ETH Zurich
Christof Ferreira Torres, ETH Zurich
Shweta Shinde, ETH Zurich
Marcus Brandenburger, IBM Research
8 July 2024

Privacy meets Blockchain►

Shared, immutable ledger►

Recording transactions and tracking assets►

All transactions and data are visible and clear to participants►

What if data are sensitive?

►►

Hospital, clinic data►

Research Institute►Company conﬁdential dataHow can we protect data privacy?
►Modern cryptography►►

Homomorphic encryption, multi-party computation, zero-knowledge proof

Hardware-based Trusted execution►

Trusted Execution Environment (TEE)2

Introduction ~ Trusted Execution
Environment (TEE)►

Hardware-aided Isolation.

►

Which protects the code and data from unauthorized access or modifications►

Data confidentiality►

Execution integrity►

Protected even against a malicious high privileged software (OS)►Remote Attestation►

Example:►Intel SGX1►AMD SEV2►

ARM TrustZone3

31

https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html
https://www.amd.com/en/developer/sev.html
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20used,Learn%20More2
3

Q: Does applying TEE solves the privacy
problem of blockchain?

4

Fabric Private Chaincode►►

Hyperledger Fabric1►

An open-source permissioned
blockchain framework►

support for smart contracts in theform of chaincode

Fabric Private Chaincode (FPC)2►An extension that enables theexecution of smart contracts in asecure enclave provided by TEEs

51

https://www.hyperledger.org/use/fabrichttps://github.com/hyperledger/fabric-private-chaincode2

Wait … maybe there is a problem …

6

Rollback Attack-Malicious peer can giveback the old version of
the encrypted data.

-And this may break theconfidentiality of theapplication.

7

Contributions► Feasibility Analysis► Solution Prototyping and Implementation► Experimental Evaluation

8

Application: Secret Keeper Smart Contract
Enclave

Worldstate
Function:
Authlist: [Alice]- Add User
- Remove User
1
Secret: Null
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html- Lock New Secret 2
https://www.amd.com/en/developer/sev.html- Reveal Secret3
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20
used,Learn%20MoreAliceBob
9Application: Secret Keeper Smart Contract
Enclave

Worldstate
Authlist: [Alice, Bob]

1

Secret: Secret_A
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html
2
https://www.amd.com/en/developer/sev.html
1. AddUser: Bob
3
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20
LockSecret: Secret_A
used,Learn%20More

AliceBob
10

Application: Secret Keeper Smart Contract
Enclave

Worldstate
Authlist: [Alice, Bob]

1

Secret: Secret_A
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html
2
https://www.amd.com/en/developer/sev.html
1. AddUser: Bob
3
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20
2. RevealSecret: Secret_A
LockSecret: Secret_A
used,Learn%20More

AliceBob
11

Application: Secret Keeper Smart Contract
Enclave

Worldstate
Authlist: [Alice]

1

Secret: Secret_B
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html
2
https://www.amd.com/en/developer/sev.html
1. AddUser: Bob
3
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20
2. RevealSecret: Secret_A
LockSecret: Secret_A
used,Learn%20More
3. RemoveUser: Bob
LockSecret: Secret_B

AliceBob12

Application: Secret Keeper Smart Contract
Enclave

Worldstate
Authlist: [Alice]

1Secret: Secret_B
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html
2
https://www.amd.com/en/developer/sev.html
1. AddUser: Bob
3
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20
2. RevealSecret: Secret_A
LockSecret: Secret_A
used,Learn%20More
3. RemoveUser: Bob
LockSecret: Secret_B
4. RevealSecret: (Failed)

AliceBob
13

Demo: https://www.loom.com/share/e3dca62f8df849229e2c6414fd374289?sid=473acda1-92ac-4ad6-89c4-ddb2f5786dd5

Rollback Attack! Secret Keeper

Action• Alice (Lock)🡪 Secret A

AuthList

Secret• [Alice, Bob]

Secret A

14

Rollback Attack! Secret Keeper

ActionAuthList

Secret• Alice (Lock)🡪 Secret A• [Alice, Bob]

Secret A• Bob (Reveal)🡪 (Success)• [Alice, Bob]

Secret A

15

Rollback Attack! Secret Keeper

ActionAuthList

Secret• Alice (Lock)🡪 Secret A• [Alice, Bob]

Secret A• Bob (Reveal)🡪 (Success)• [Alice, Bob]

Secret A• [Alice]

Secret A• Alice (Remove) 🡪 Bob

16

Rollback Attack! Secret Keeper

ActionAuthList

Secret• Alice (Lock)🡪 Secret A• [Alice, Bob]

Secret A• Bob (Reveal)🡪 (Success)• [Alice, Bob]

Secret A• Alice (Remove) 🡪 Bob• [Alice]

Secret A• Alice (Lock)• [Alice]

Secret B

🡪 Secret B

17

Rollback Attack! Secret Keeper

ActionAuthList

Secret• Alice (Lock)🡪 Secret A• [Alice, Bob]

Secret A• Bob (Reveal)🡪 (Success)• [Alice, Bob]

Secret A• Alice (Remove)🡪 Bob• [Alice]

Secret A• Alice (Lock)🡪 Secret B• [Alice]

Secret B• Bob (Reveal)🡪 (Success)• [Alice, Bob]

Secret B
18

Demo: https://www.loom.com/share/e540bf6395f94ab8ba547bd43942d063?sid=b32de7ea-e5d7-43ef-9e06-bf11b3cfc6ff

Q: How can we overcome this issue?

19

Related Work & Analysis► Solution for rollback attack on TEE1►

Monotonic Counter1

►

ROTE2

►

Enclave DB3

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjb8I3dr8D_AhVe_7sIHTj3BhgQFnoECAcQAQ&url=https%3A%2F%2Fcdrdv2-public.intel.com%2F671564%2Fintel-sgx-platform-services.pdf&usg=AOvVaw3Cbr31cwfEXIgDGYZoXsgr
220
Sinisa Matetic et al. “ROTE: Rollback Protection for Trusted Execution”. In: Pro- ceedings of the 26th USENIX Conference on Security Symposium. SEC’17.
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/matetic3
C. Priebe, K. Vaswani, and M. Costa, “EnclaveDB: A Secure Database Using SGX,” in Proc. IEEE Symposium on Security and Privacy (SP), 2018. https://ieeexplore.ieee.org/document/8418608

Strawman approach: Single Key Value Storage (SKVS)►►

We only store a single key in KVS
Advantages:►►

Naive to Implement.

Disadvantages:►►Performance drop as the application state gets larger
Concurrent transactions result in conflicts (which may impact performance badly)

Instead of doing this,

We do this,Data in worldstate:

Data in worldstate:{{“Data”: {“Alice”: “Enc Alice’s data”,“Encrypted of both alice & bob objects”“Bob”: “Enc Bob’s data”,}}}
21Trusted Ledger Enclave (TLE)1►Having an extra enclave
to track the ledger andstore the integrity
metadata of the KVS.

►Advantages:►►

Disadvantages:►1O(1) verification on KVS

Original FPC's v1.0 RPC
didn't implement due tomaintenancedifficulties.

M. Brandenburger, C. Cachin, R. Kapitza and A. Sorniotti, "Trusted Computing Meets Blockchain: Rollback Attacks and a Solution for Hyperledger Fabric," 2019 38th Symposium on Reliable Distributed Systems (SRDS), Lyon,France, 2019, pp. 324-32409, doi: 10.1109/SRDS47363.2019.00045.
2
https://www.edgeless.systems/products/ego/22

Our Approach

23

Merkle Tree Approach (MTA) Architecture
Verify Merkle
PathUpdate & query :O(log n) (n = # of data)

Invoke CC with
Merkle RootInvoke Chaincode:O(m) (m = # of peers)

Get State ->Value + MPath

Require Merkle Root from allpeers before invoke chaincode

Query forMerkle Root

Update Merkle
24ComponentHow we maintain the merkle tree►

Each Leaf contain Each
Key Value Pair fromwordstate.

►During Get State,
Return Leaf + related
Merkle Path25

MTA Execution Flow
Addition Step:(0. Query Merkle Root)(1a. Agree Merkle Root)(2b. Verify value)(10. Update Merkle Tree)
Modify Step:(1. Invoke CC with M)(2a. Return Value & MPath)26

Evaluation► Trusting Computing Base (TCB) Size
► Performance Impact► Security Analysis

27

Trusting Computing Base (TCB)

Own Enclave
component(inside TCB)

Enclave STUB
(Inside TCB)

Client SDK(Outside TCB)

Fabric Peer
(Outside TCB)

SKVS

0

141

00

TLE

6700+

162

00

Merkle

0534

105

2000+

Shows how many lines of code (LoCs) added for each solution
28

Test on # of clients.
(Expectation: Client++, Throughput++)►All Solution reachsaturation at 128 client►

MTA perform just as goodas Native FPC►TLE perform decrease as
faster as the # of clientincrease29

Test on # of peers.
(Expectation: Peers++, Latency++, MTA will become worst)►

Native: linear latency increase►

MTA: superlinear latencyincrease. (because we queryeach peer 1-by-1)►

TLE: Still perform the worst

30

Test on Ext Secret Keeper►

MTA: perform as good as Native►

TLE: has the worst performance►

SKVS: performance drop as txn
number increase►

Read & Write the whole data foreach action.

►More Data -> More Time todecrypt & encrypt31Full Article1321

https://github.com/chenchanglew/systex2024/blob/2bd229b4d4c4e6be9648c411aa8e4d744eff3524/systex24-final56.pdf

Lessons LearnedSolutions

Advantages

Disadvantages

CommentSKVS- Small TCB (141 LoC)
- Easy to implemented- no Fabric Peer’s Modification- Bad performance in concurrent
transactions- Always load all data in the enclave- Good for application
dependent on High ReadOperation.

TLE- Transparent for the clients.
- In theory good performance (O(1)
for retrieve & update)- Mediocre Performance (peak 65% ofNative FPC)
- Need to edit Fabric Peer’s code
- Relatively large TCB (6000+, plus
fabric peer code)- Good for integrate with oldsystem. (Just require to update
the chaincode)

MTA- Small TCB (500+ LoC)
- Need to edit Fabric Peer's code
- Great Performance (95% of Native - Need to edit Client side SDKFPC)- Cannot integrate with old system.

- Good for new applicationthat require rollback
protection.

33

Thanks!

Artifact links (feel free to play around and break it XD)
34

Reference Slides►Intel SGX:
https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html►AMD SEV: https://www.amd.com/en/developer/sev.html►

ARM Trustzone:
https://www.arm.com/technologies/trustzone-for-cortex-m#:~:text=Arm%20TrustZone%20technology%20is%20used,Learn%20More►

Hyperledger Fabric: https://www.hyperledger.org/use/fabric►Fabric Private Chaincode: https://github.com/hyperledger/fabric-private-chaincode►

SGX Monotonic counters:
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjb8I3dr8D_AhVe_7sIHTj3
BhgQFnoECAcQAQ&url=https%3A%2F%2Fcdrdv2-public.intel.com%2F671564%2Fintel-sgx-platform-services.pdf&usg=AOvVaw3Cbr31cwfEXIgDGYZoXsgr►

ROTE: Sinisa Matetic et al. “ROTE: Rollback Protection for Trusted Execution”. In: Pro- ceedings of the 26th
USENIX Conference on Security Symposium. SEC’17. Vancouver, BC, Canada: USENIX Association, 2017, pp.
1289–1306. isbn: 9781931971409.
https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/matetic►

Trusted Ledger Enclave (TLE): M. Brandenburger, C. Cachin, R. Kapitza and A. Sorniotti, "Trusted Computing
Meets Blockchain: Rollback Attacks and a Solution for Hyperledger Fabric," 2019 38th Symposium on Reliable
Distributed Systems (SRDS), Lyon, France, 2019, pp. 324-32409, doi: 10.1109/SRDS47363.2019.00045.
https://ieeexplore.ieee.org/document/9049585►

Formal Verification: 1Saharsh Agrawal and Karen Tu. “Enabling Verifiable Execution of Distributed Secure
Enclave Platforms”. In Berkeley EECS-2021-153,35
https://www2.eecs.berkeley.edu/Pubs/TechRpts/2021/EECS-2021-153.html►Merkle Tree: https://en.wikipedia.org/wiki/Merkle_tree