SecureFS: A Secure File System for Intel SGX

SecureFS

A trusted execution environment or a TEE facilitates the secure execution of a workload on a remote untrusted server. In a TEE, the confidentiality, integrity, and freshness prop- erties for the code and data hold throughout the execution. In a TEE setting, specifically Intel SGX, even the operating system (OS) is not trusted. This results in certain limitations of a secure application’s functionality, such as no access to the file system and network – as it requires OS support. Prior works have focused on alleviating this problem by allowing an application to access the file system securely. However, we show that they are susceptible to replay at- tacks, where replaying an old encrypted version of a file may remain undetected. Furthermore, they do not consider the impact of Intel SGX operations on the design of the file system.

To this end, we present SecureFS, a secure, efficient, and scalable file system for Intel SGX that ensures confidential- ity, integrity, and freshness of the data stored in it. SecureFS can work with unmodified binaries. SecureFS also consid- ers the impact of Intel SGX to ensure optimal performance. We implement a prototype of SecureFS on a real Intel SGX machine. We incur a minimal overhead (≈ 1.8%) over the current state-of-the-art techniques while adding freshness to the list of security guarantees.

Running the code

We use a CMake based build.

Assuming ROOT is the path where you have the code.

mkdir build
cd build
cmake ..
make -j1

# Assuming that you have iozone installed.


# Running Non-SGX Version
LD_PRELOAD=<ROOT>/build/libSF_FAT_ENC_HASH_PERF.so iozone -i 0 -i 1 -s 100m -r 4m

# Running SGX Version.
# Assuming you have the SDK and the Driver working

cd <ROOT>/sgx/enclave_CallerCode
LD_PRELOAD=<ROOT>/sgx/enclave_CallerCode/libSF_FAT_ENC_HASH_PERF_SGX.so iozone -i 0 -i 1 -s 100m -r 4m

# This will also print SecureFS stat on the scree,
# SecureFS can be configured to run in inode-mode also. By default, it runs in FAT mode.

TODO

• Add instructions for different modes.
• ADd instructions for library operating system.

In the meanwhile, I enourage you to check CMakeLists.txt to get information about different flags. Also, check LD_PRELOAD option in Graphene-SGX to run SecureFS with Graphene-SGX.