ZeroCache means neither user credentials (i.e. private keys) nor sensitive data (e.g., HTTPS messages) will be discoverd by any untrusted third-parties (e.g., admin insiders, co-located tenants) both in transit and at rest, because the plaintext information is protected inside Intel SGX enclaves and all input/output flows are encrypted!
Certainly we are glad that you will choose ZeroCache to establish your own services (e.g., CDN serivce) on any clouds that have enabled SGX features!
Welcome and enjoy, feel free to send your feedbacks to [email protected].
Special Thanks to Pierre-Louis Aublin and his TaLoS.
Build LibreSSL:
cd libressl-2.8.3/crypto
make -j16
Build Proxy:
cd nginx-1.18.0-proxy
sh ./proxy.sh
Build Server:
cd nginx-1.18.0-server
sh ./doit.sh
# setup server
cd nginx-1.18.0-server
./objs/nginx
# set proxy
cd nginx-1.18.0-proxy
./objs/nginx
# benchmark using apache-bench
ab -n 5000 -c 10 https://localhost:8889/index.html
- Gateway
- TEEX-UCloud Privacy Preserving Queries: mainly used for parsing requests from user's encryted queries, plus statistics data collection.
- CDN Filter
- Firewall/IDS
- Hardened NF
- Load Balancer
- SafeBricks: Shielding Network Functions in the Cloud (NSDI 2018)
- ENDBOX: Scalable Middlebox Functions Using Client-Side Trusted Execution (DSN 2018)
- Slick: Secure Middleboxes using Shielded Execution
- LightBox: Full-stack Protected Stateful Middlebox at Lightning: https://github.com/lightbox-impl/LightBox
- ShieldBox: Secure Middleboxes using Shielded Execution (SOSR 2018)
- Enhancing Security and Privacy of Tor's Ecosystem by Using Trusted Execution Environments (NSDI 2017)
- PRI: Privacy Preserving Inspection of Encrypted Network Traffic (Oakland workshop 2016): Slides
- Making TLS and Middleboxes Play Together … Nicely
- And Then There Were More: Secure Communication for More Than Two Parties
- s2n : an implementation of the TLS/SSL protocols
- Nginx
- LVS
- HAProxy
- mitmproxy: An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers
As nginx is the most popular proxy and its simplicity in configuration, we use it as a part of our secured middlebox.
- LibreSSL: Modernizing the codebase, improving security, and applying best practice development processes
- BoringSSL: A fork of OpenSSL that is designed to meet Google's needs
- OpenSSL: A robust, commercial-grade, full-featured, and Open Source cryptography library
According to Cryptography and Encryption Libraries, LibreSSL has the best code quality (L4). That's why we adopt it inside enclaves.
-
2021.3.1
- Update to nginx-1.18.0.
- Update to libressl-3.2.4 (WIP).
-
2019.1.27
- Test with Proxy mode.
- Bug fixes for double HTTPS channel.
- HTTP body protection within enclave boundary.
- Remove
.cpp
files dependency. - Adapted with
DEFS
flag with originalMakefile
. - Add technical references.
-
2019.1.26
- Regression Test.
-
2019.1.25
- Minimal modifications for libressl-2.4.1.
- Fixed
printf
,strndup
symbols that should've turned out to be undefined originally in the TaLoS project. - Fixed
ssl_session_cache
option for nginx.conf, by supporting theocall_get_session_cb_trampoline
method forngx_ssl_get_cached_session
. - Try to build with libressl v2.8.3.
- Support nginx-1.15.8 with libressl-2.8.3, little ssl modification were made.
-
2019.1.24
- Using
-U_FORTIFY_SOURCE
instead of-D_FORTIFY_SOURCE=2
. However, withFORTIFY_SOURCE
enabled, GCC tries to uses buffer-length aware replacements for functions likestrcpy
,memcpy
,memset
, etc.
- Using
-
2019.1.21
- Merge necessary ecalls to one file.
-
2019.1.20
- Split ecalls for nginx, maintain minimal sets, ready to update libressl v2.8.2 (Stable release).
- Checked. Original LibreSSL include file will do for the Nginx building.
No Header FILEs dependency.
- Delete
.section .init
incpuid-elf-x86_64.S
, so to omit-ignore-init-sec-error
sgx-sign error.
-
2019.1.19
- Code base clean, remove unnecessary e/ocall interfaces.
- Update
doit.sh
script for automatic modification in nginx projects. - Tested with the following versions:
nginx-1.11.0
,nginx-1.12.2
,nginx-1.14.2
,nginx-1.15.8
. - Added interfaces in ecalls.c to define symbols in nginx-1.15.8.
-
2019.1.18
- HTTP body protection using AES-128-GCM.
- In-Enclave private key and certificate generation. Replace TLS context when establishing a new TLS session (via
SSL_new()
); - Currently cannot support multi-process nginx, as enclave cannot be shared between master/worker processes after fork in
src/os/unix/ngx_process.c
.
-
2019.1.17
- Using nginx as the proxy for secure content-based router. Mainline version nginx-1.15.8 as the HTTPS server, stable version nginx-1.14.2 as the proxy.
-
2019.1.10
- Update nginx version to latest stable version 1.14.2 (2018-12-04).
- Modified
nginx-1.14.2/src/event/ngx_event_openssl.c
for compatibility. To look for reasons, please refer tonginx-1.14.2/debugging.txt
. - Note that the session ticket is disabled, otherwise, more interfaces (sgx-ecalls) should be added.