Dependable persistent memory architectures
Creators: name: Stavrakakis, Dimitrios
Publisher: name: The University of Edinburgh
Year: 2024
Subjects: dependability
persistent memory
memory safety
security
PMDK
SGX
systems

description: The modern cloud computing infrastructure is shifting towards disaggregated system architectures, primarily due to the emergence of the Compute Express Link (CXL) technology. In such setups, byte-addressable persistent memory (PM) is anticipate to become a fundamental building block as it provides opportunities for high-volume pools of low-latency, non-volatile memory. While offloading critical data management operations to the cloud is advantageous, at the same time, it is imperative to provide reliable and trustworthy services in untrusted cloud environments. However, the incorporation of PM in the cloud providers’ system stack, despite its performance benefits, introduces new challenging dependability issues, especially in the context of safety and security. Unfortunately, in the cloud infrastructure, the underlying storage, network, and computing stacks are entirely managed by untrusted third-party providers. In such settings, a powerful adversary, e.g., a malicious system administrator, can control the entire software system stack (including the OS/hypervisor layers) and even perform physical attacks (e.g., memory probes) aiming to compromise the security properties of both PM data and storage operations. Moreover, attackers can gain control over the network stack and tamper with network traffic, amplifying the vulnerability vectors in untrusted cloud environments. Additionally, memory safety bugs in the deployed software constitute another critical source of reliability and security issues. Memory safety bugs are also prevalent in PM because, similarly to its volatile counterpart, it employs a byte-addressable programming model. To this end, uncontrolled memory accesses can result in various software bugs and severe vulnerabilities that potentially lead to information exposure or leakage of secrets, thus posing security and privacy concerns. In this thesis, we aim to provide system designers with the means to build an endto-end, dependable persistent memory architecture. Precisely, we design two memory safety solutions tailored for PM (SAFEPM, SPP), targeting both debugging and production environments. We base our design on effective, well-tested approaches that have been extensively applied for volatile memory systems. On top of that, we combine modern hardware advancements in trusted computing, high-performance networking, and byte-addressable PM to build an end-to-end secure PM data management system (ANCHOR). More specifically, • SAFEPM is a memory safety mechanism for PM-based applications that detects spatial and temporal memory safety violations. SAFEPM employs a shadow memory approach augmented with crash-consistent data structures, ensuring safety across reboots and crashes. It is based on Google’s AddressSanitizer (ASan) and offers comprehensive memory safety with reasonable overheads, uncovering realworld bugs in the Persistent Memory Development Kit (PMDK), the de-facto programming framework for PM. • SPP is a low-overhead, tagged pointer-based memory safety solution for PM. SPP protects against buffer overflows in PM applications. It enhances persistent pointers with memory safety metadata, which is embedded in native tagged pointers during runtime. SPP is built on the LLVM compiler infrastructure and is integrated with the PMDK. To promote applicability in existing toolchains, SPP maintains the PMDK API intact and requires no source code modifications. SPP incurs low runtime and space overheads while preserving the crash consistency property both for the PM data and its memory safety metadata. • ANCHOR enables building end-to-end secure PM data management systems with reasonable performance implications. ANCHOR extends the hardware-assisted security properties — confidentiality, integrity, and freshness — of trusted execution environments (TEEs) to PM. Precisely, ANCHOR secures PM data leveraging confidential and authenticated data structures, preserves crash consistency with a formally proven secure logging protocol, and allows for secure remote operations via a secure network stack based on kernel-bypass networking. It further offers a formally verified attestation protocol for trust establishment and exposes intuitive APIs tailored for secure data management on byte-addressable storage devices. Collectively, these systems contribute to establishing security and reliability in modern untrusted cloud infrastructures that incorporate persistent memory as their storage medium.