Juhyeng Han
ABSTRACT
The hardware security module (HSM) has been used as a root of trust for various key management services. At the same time, rapid innovation in emerging industries, such as container-based microservices, accelerates demands for scaling security services. However, current on-premises HSMs have limitations to afford such demands due to the restricted scalability and high price of deployment. This paper presents ScaleTrust, a framework for scaling security services by utilizing HSMs with SGX-based key management service (KMS) in a collaborative, yet secure manner. Based on a hierarchical model, we design a cryptographic workload distribution between HSMs and KMS enclaves to achieve both the elasticity of cloud software and the hardware-based security of HSM appliances. We demonstrate practical implications of ScaleTrust using two case studies that require secure cryptographic operations with low latency and high scalability.
- Asylo: An Open and Flexible Framework for Enclave Applications. https://asylo.dev.Google Scholar
- AWS CloudHSM. https://aws.amazon.com/cloudhsm.Google Scholar
- Egnyte Key Management. https://www.egnyte.com/encryption-key-management.html.Google Scholar
- Google Cloud HSM. https://cloud.google.com/hsm.Google Scholar
- IBM Cloud HSM. https://www.ibm.com/cloud/hardware-security-module.Google Scholar
- IBM Systems cryptographic HSMs. https://www.ibm.com/security/cryptocards/hsms.Google Scholar
- Intel® Software Guard Extensions SDK for Linux* OS. https://github.com/intel/linux-sgx.Google Scholar
- Official Docker v17.06 documentation. Manage swarm security with public key infrastructure [Accessed Aug. 20, 2019].Google Scholar
- Open Enclave SDK. https://openenclave.io/sdk.Google Scholar
- OpenDNSSEC SoftHSM. https://www.opendnssec.org/softhsm.Google Scholar
- SafeNet Hardware Security Modules. https://safenet.gemalto.com/data-encryption/hardware-security-modules-hsms.Google Scholar
- Thales eSecurity Key Management. https://www.thalesesecurity.com/products/key-management.Google Scholar
- WolfSSL Intel SGX. https://www.wolfssl.com/wolfssl-intel-sgx-fips-140--2.Google Scholar
- FIPSPUB 140--2. Security requirements for cryptographic modules, 2001.Google Scholar
- J.-B. Bédrune et al. Everybody be Cool, This is a Robbery! https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf, 2019.Google Scholar
- J. G. Beekman et al. Challenges For Scaling Applications Across Enclaves. In Proc. SysTEX. ACM, 2017.Google ScholarDigital Library
- J. Bradley et al. JSON web token (JWT). https://tools.ietf.org/html/rfc7519, 2015.Google Scholar
- S. Chakrabarti et al. Intel SGX Enabled Key Manager Service with OpenStack Barbican. arXiv preprint arXiv:1712.07694, 2017.Google Scholar
- S. Chakrabarti et al. Scaling Intel® Software Guard Extensions Applications with Intel® SGX Card. In Proc. HASP. ACM, 2019.Google ScholarDigital Library
- L. Chen. Microservices: architecting for continuous delivery and devops. In Proc. ICSA. IEEE, 2018.Google Scholar
- CloudFlare. The DNSSEC Root Signing Ceremony. https://www.cloudflare.com/dns/dnssec/root-signing-ceremony.Google Scholar
- EFTLAB. HSMs in a Payment Industry. https://www.eftlab.com/hsms-in-a-payment-industry.Google Scholar
- J. Haswell. SSD Architectures to Ensure Security and Performance. Flash Memory Summit, 2016.Google Scholar
- F. R. Konkel. The Pentagon isn't ready yet for classified information to be stored off-premise in the cloud. https://www.nextgov.com/emerging-tech/2015/02/dod-wants-physical-separation-classified-data-cloud-now/105753.Google Scholar
- D. Liu et al. Veriui: Attested Login for Mobile Devices. In Proc. HotMobile, 2014.Google ScholarDigital Library
- S. Luo et al. TZ-KMS: A Secure Key Management Service for Joint Cloud Computing with ARM TrustZone. In Proc. SOSE, 2018.Google Scholar
- F. McKeen et al. Innovative Instructions and Software Model for Isolated Execution. In Proc. HASP, 2013.Google ScholarDigital Library
- R. Stubbs. Turning Cryptography into a Service. https://www.cryptomathic.com/news-events/blog/turning-cryptography-into-a-service-part-1.Google Scholar
- Thales eSecurity. What is FIPS 140-2? https://www.thalesesecurity.com/faq/key-secrets-management/what-fips-140-2.Google Scholar
- J. Wilder. PCI Requirement 3.6.6 - Using Split Knowledge & Dual Control. https://kirkpatrickprice.com/video/pci-requirement-3-6-6-using-split-knowledge-dual-control/.Google Scholar
- E.Wolff. Microservices: flexible software architecture. Addison-Wesley Professional, 2016.Google Scholar
- T. Yarygina et al. Overcoming Security Challenges in Microservice Architectures. In Proc. SOSE. IEEE, 2018.Google ScholarCross Ref
- J. Zhang et al. Data Security and Privacy-Preserving in Edge Computing Paradigm: Survey and Open Issues. IEEE Access, 2018.Google ScholarCross Ref
Index Terms
- Toward scaling hardware security module for emerging cloud services
Recommendations
Toward a framework for cloud security
ICA3PP'10: Proceedings of the 10th international conference on Algorithms and Architectures for Parallel Processing - Volume Part IIWhile the emergence of cloud computing has made it possible to rent information technology infrastructures on demand, it has also created new security challenges. The primary security concern is trusting data (or resources in general) on another ...
Cloud Computing Security: Amazon Web Service
ACCT '15: Proceedings of the 2015 Fifth International Conference on Advanced Computing & Communication TechnologiesCloud Computing is a recently emerged model which is becoming popular among almost all enterprises. It involves the concept of on demand services which means using the cloud resources on demand and we can scale the resources as per demand. Cloud ...
Cloud-based security services for the smart grid
CASCON '13: Proceedings of the 2013 Conference of the Center for Advanced Studies on Collaborative ResearchIn recent years, cloud-based services become very popular. Their market is expanding every day. Security as a service (SECaaS) is a promising area of cloud computing. It offers cost-effective cyber security solutions to client entities. It can be a good ...
Comments