Presentation
When Cloud TEEs Encounter Availability: A Lightweight Framework for Verifiable CPU Availability
DescriptionTrusted Execution Environments (TEEs) provide confidentiality and integrity, but their reliance on untrusted schedulers makes them vulnerable to CPU Denial-of-Service (DoS) attacks, compromising availability.
Existing solutions either enlarge the Trusted Computing Base (TCB), rely on static closed-world workload assumptions that block dynamic enclave admission, or require hardware modifications.
We propose AvaTEE, a lightweight framework for verifiable CPU availability in TEEs.
AvaTEE uniquely integrates resource negotiation into remote attestation, providing a verifiable resource commitment pre-deployment.
At runtime, a trusted scheduler performs dynamic monitoring and preemptive arbitration to mitigate DoS attacks.
We evaluate AvaTEE on an FPGA.
The results demonstrate that it (1) provides robust protection under contention, where native TEEs suffer a 94.8\% performance loss and up to a 19.7$\times$ slowdown; (2) incurs negligible overhead (less than 2\%) during enclave startup and normal runtime; and (3) maintains near-native performance, with only 1.70\% average overhead compared to Keystone.
Existing solutions either enlarge the Trusted Computing Base (TCB), rely on static closed-world workload assumptions that block dynamic enclave admission, or require hardware modifications.
We propose AvaTEE, a lightweight framework for verifiable CPU availability in TEEs.
AvaTEE uniquely integrates resource negotiation into remote attestation, providing a verifiable resource commitment pre-deployment.
At runtime, a trusted scheduler performs dynamic monitoring and preemptive arbitration to mitigate DoS attacks.
We evaluate AvaTEE on an FPGA.
The results demonstrate that it (1) provides robust protection under contention, where native TEEs suffer a 94.8\% performance loss and up to a 19.7$\times$ slowdown; (2) incurs negligible overhead (less than 2\%) during enclave startup and normal runtime; and (3) maintains near-native performance, with only 1.70\% average overhead compared to Keystone.
Event Type
Research Manuscript
TimeMonday, July 273:30pm - 3:42pm PDT
LocationMtg Room 203C