TWC: Medium: Collaborative: DIORE: Digital Insertion and Observation Resistant Execution

云计算允许用户将数据和计算委托给云提供商，代价是放弃对其计算基础设施的物理控制。对计算平台具有物理访问权限的攻击者可以执行各种物理攻击，称为数字插入和观察攻击，包括探测存储器总线、篡改存储器和冷启动风格的攻击。虽然内存加密可以防止数字观测下的数据直接泄露，但即使是对加密数据的内存访问模式也可能泄露敏感信息。这项工作将使组织能够安全地将其计算基础设施外包给不受信任的云提供商，同时保持类似的安全级别，就像在内部托管基础设施一样。该项目将开发DIORE(数字插入和抗观察执行)，这是一个免受数字插入和观察攻击的组合硬件软件平台。DIORE提供内存跟踪不经意执行，依赖于不经意RAM的高效硬件实现，以及用于对程序进行分区的新颖编译器技术，从而将不经意RAM访问降至最低。这确保了有权访问程序执行的内存跟踪的对手除了故意泄露的内容外，不会了解任何关于代码或数据的信息。DIORE为涉及敏感信息的新的云应用程序提供了可能性，如基因组、医疗或金融数据--这些领域被认为对当今的云过于隐私敏感。

Cloud computing allows users to delegate data and computation to cloud providers, at the cost of giving up physical control of their computing infrastructure. An attacker with physical access to the computing platform can perform various physical attacks, referred to as digital insertion and observation attacks, which include probing memory buses, tampering with memory, and cold-boot style attacks. While memory encryption can prevent direct leakage of data under digital observation, memory access patterns to even encrypted data may leak sensitive information. This work will allow organizations to securely outsource their computing infrastructure to an untrusted cloud provider, while preserving a similar level of security as if hosting the infrastructure in houseThis project will develop DIORE (Digital Insertion and Observation Resistant Execution) which is a combined hardware software platform immune to digital insertion and observation attacks. DIORE provides memory-trace oblivious execution, relying on efficient hardware implementations of Oblivious RAM, and novel compiler techniques for partitioning programs such that Oblivious RAM accesses are minimized. This ensures that an adversary with access to a program execution's memory trace learns nothing about the code or data other than what is revealed intentionally. DIORE opens up possibilities for new cloud applications involving sensitive information such as genomic, medical, or financial data -- domains that are considered too privacy sensitive for today's cloud.