VC3: Trustworthy Data Analytics in the Cloud Using SGX

TLDR

We present VC3, the first system that enables users to run distributed MapReduce computations in the cloud while keeping their code and data secret and ensuring the correctness and completeness of their results. VC3 runs on unmodified Hadoop, keeps Hadoop, the operating system and the hypervisor out of the trusted computing base, uses SGX processors to isolate memory regions, deploys new protocols for secure distributed MapReduce, and optionally enforces region self‑integrity invariants to prevent unsafe memory attacks. Experimental results on common benchmarks show that VC3 performs well compared with unprotected Hadoop, with an average runtime overhead of only 4.5 % with write integrity and 8 % with read/write integrity.

Abstract

We present VC3, the first system that allows users to run distributed MapReduce computations in the cloud while keeping their code and data secret, and ensuring the correctness and completeness of their results. VC3 runs on unmodified Hadoop, but crucially keeps Hadoop, the operating system and the hyper visor out of the TCB, thus, confidentiality and integrity are preserved even if these large components are compromised. VC3 relies on SGX processors to isolate memory regions on individual computers, and to deploy new protocols that secure distributed MapReduce computations. VC3 optionally enforces region self-integrity invariants for all MapReduce code running within isolated regions, to prevent attacks due to unsafe memory reads and writes. Experimental results on common benchmarks show that VC3 performs well compared with unprotected Hadoop: VC3's average runtime overhead is negligible for its base security guarantees, 4.5% with write integrity and 8% with read/write integrity.