Civet: An Efficient Java Partitioning Framework for Hardware Enclaves
Civet: An Efficient Java Partitioning Framework for Hardware Enclaves
复制标题
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Chia-che Tsai;Jeongseok Son;Bhushan Jain;John McAvey;Raluca A. Popa;Donald E. Porter
中科院分区：
文献类型：
--
作者：
Chia-che Tsai;Jeongseok Son;Bhushan Jain;John McAvey;Raluca A. Popa;Donald E. Porter
硬件飞地旨在执行小块敏感代码或对敏感数据进行操作，与更大、可信度较低的系统隔离开来。对大型遗留应用程序进行分区需要付出巨大努力。对用托管语言（如Java）编写的应用程序进行分区更具挑战性，因为语言具有可变特性、类库中的代码可达性广泛，以及必然要使用重量级运行时。Civet是一个用于将Java应用程序分区到飞地的框架。Civet减少了飞地中的代码行数，并使用语言级别的防御措施，包括深度类型检查和动态污点跟踪，来强化飞地接口。Civet还提出了一种分区式Java运行时设计，包括一种针对飞地特性进行优化的垃圾回收设计。Civet对于数据密集型工作负载是高效的；对Hadoop映射器进行分区可将飞地开销从10倍降低到16 - 22%（无污点跟踪时）或70 - 80%（有污点跟踪时）。
Hardware enclaves are designed to execute small pieces of sensitive code or to operate on sensitive data, in isolation from larger, less trusted systems. Partitioning a large, legacy application requires significant effort. Partitioning an application written in a managed language, such as Java, is more challenging because of mutable language characteristics, extensive code reachability in class libraries, and the inevitability of using a heavyweight runtime. Civet is a framework for partitioning Java applications into enclaves. Civet reduces the number of lines of code in the enclave and uses language-level defenses, including deep type checks and dynamic taint-tracking, to harden the enclave interface. Civet also contributes a partitioned Java runtime de-sign, including a garbage collection design optimized for the peculiarities of enclaves. Civet is efficient for data-intensive workloads; partitioning a Hadoop mapper reduces the en-clave overhead from 10 × to 16–22% without taint-tracking or 70–80% with taint-tracking.