Security, Performance and Energy Trade-offs of Hardware-assisted Memory Protection Mechanisms

by   Christian Göttel, et al.

The deployment of large-scale distributed systems, e.g., publish-subscribe platforms, that operate over sensitive data using the infrastructure of public cloud providers, is nowadays heavily hindered by the surging lack of trust toward the cloud operators. Although purely software-based solutions exist to protect the confidentiality of data and the processing itself, such as homomorphic encryption schemes, their performance is far from being practical under real-world workloads. The performance trade-offs of two novel hardware-assisted memory protection mechanisms, namely AMD SEV and Intel SGX - currently available on the market to tackle this problem, are described in this practical experience. Specifically, we implement and evaluate a publish/subscribe use-case and evaluate the impact of the memory protection mechanisms and the resulting performance. This paper reports on the experience gained while building this system, in particular when having to cope with the technical limitations imposed by SEV and SGX. Several trade-offs that provide valuable insights in terms of latency, throughput, processing time and energy requirements are exhibited by means of micro- and macro-benchmarks.


page 1

page 3

page 5


Security, Performance and Energy Implications of Hardware-assisted Memory Protection Mechanisms on Event-based Streaming Systems

Major cloud providers such as Amazon, Google and Microsoft provide nowad...

ZipLine: In-Network Compression at Line Speed

Network appliances continue to offer novel opportunities to offload proc...

SGX-Aware Container Orchestration for Heterogeneous Clusters

Containers are becoming the de facto standard to package and deploy appl...

HEATS: Heterogeneity- and Energy-Aware Task-based Scheduling

Cloud providers usually offer diverse types of hardware for their users....

A Brief Review on Some Architectures Providing Support for DIFT

Dynamic Information Flow Tracking (DIFT) is a technique to track potenti...

Estimating the Impact of BGP Prefix Hijacking

BGP prefix hijacking is a critical threat to the resilience and security...