TWC: Medium: Collaborative: DIORE: Digital Insertion and Observation Resistant Execution

云计算允许用户将数据和计算委托给云提供商，其代价是放弃对其计算基础设施的物理控制。对计算平台进行物理访问的攻击者可以执行各种物理攻击，称为数字插入和观察攻击，包括探测内存总线、篡改内存和冷启动式攻击。虽然内存加密可以防止数字观测下数据的直接泄露，但即使加密数据的内存访问模式也可能泄露敏感信息。这项工作将允许组织将其计算基础设施安全地外包给不受信任的云提供商，同时保持与内部托管基础设施类似的安全级别。该项目将开发DIORE（数字插入和观察抵抗执行），这是一个组合的硬件软件平台，可免受数字插入和观察攻击。DIORE提供内存跟踪无关执行，依赖于无关RAM的高效硬件实现，以及用于分区程序的新型编译器技术，这样可以最大限度地减少无关RAM访问。这确保了访问程序执行的内存跟踪的攻击者除了有意透露的内容外，对代码或数据一无所知。DIORE为涉及基因组、医疗或金融数据等敏感信息的新云应用程序开辟了可能性，这些领域对于当今的云来说被认为过于隐私敏感。

Cloud computing allows users to delegate data and computation to cloud providers, at the cost of giving up physical control of their computing infrastructure. An attacker with physical access to the computing platform can perform various physical attacks, referred to as digital insertion and observation attacks, which include probing memory buses, tampering with memory, and cold-boot style attacks. While memory encryption can prevent direct leakage of data under digital observation, memory access patterns to even encrypted data may leak sensitive information. This work will allow organizations to securely outsource their computing infrastructure to an untrusted cloud provider, while preserving a similar level of security as if hosting the infrastructure in houseThis project will develop DIORE (Digital Insertion and Observation Resistant Execution) which is a combined hardware software platform immune to digital insertion and observation attacks. DIORE provides memory-trace oblivious execution, relying on efficient hardware implementations of Oblivious RAM, and novel compiler techniques for partitioning programs such that Oblivious RAM accesses are minimized. This ensures that an adversary with access to a program execution's memory trace learns nothing about the code or data other than what is revealed intentionally. DIORE opens up possibilities for new cloud applications involving sensitive information such as genomic, medical, or financial data -- domains that are considered too privacy sensitive for today's cloud.