Skip to content

Fischer0522/AtomicDisk

Repository files navigation

AtomicDisk: A Secure Virtual Disk for TEEs against Eviction Attacks

Overview

AtomicDisk is a secure virtual disk designed to protect Trusted Execution Environments (TEEs) against eviction attacks, a novel vulnerability where adversaries exploit transient on-disk states (vulnerable snapshots) generated by cache evictions. Built as an enhancement to the state-of-the-art SGX-PFS, AtomicDisk introduces sync atomicity to ensure all writes before a sync are committed atomically, eliminating vulnerable snapshots while maintaining performance parity with SGX-PFS.

Key Features

  • Sync Atomicity: Guarantees that writes are either fully committed (after sync) or discarded (if uncommitted), preventing adversaries from exploiting transient states.
  • Backward Compatibility: Integrates seamlessly with existing TEE frameworks (e.g., Occlum) without modifying upper-layer applications or file systems.
  • Security Guarantees: Provides confidentiality, integrity, freshness, consistency, and sync atomicity (CIFCA), outperforming SGX-PFS and Linux-based solutions.
  • Efficient Recovery: Uses an enhanced journaling mechanism to restore only committed writes during crash recovery.

Technical Highlights

  • Design: Extends SGX-PFS with an internal commit operation triggered by sync requests. Uncommitted writes are ignored during recovery.
  • Implementation: Built in Rust (~5,000 LoC) and integrated with the Occlum library OS for Intel SGX.
  • Performance: Matches SGX-PFS in I/O throughput (tested with FIO, YCSB, and real-world traces) while reducing vulnerable snapshots from hundreds of thousands to one per sync.

Evaluation Results

  • Security: SGX-PFS generates 276K–788K vulnerable snapshots per trace; AtomicDisk ensures exactly one valid snapshot per sync.
  • Performance: AtomicDisk achieves:
    • 1.2×–7.5× slower writes than dm-crypt (due to Merkle Hash Tree overhead).
    • Similar read/write speeds to SGX-PFS.

Getting Started

  • Codebase: Available on GitHub: AtomicDisk.
  • Attack Reproduction: Demo and artifacts for eviction attacks: EvictionAttack.
  • Dependencies: Requires Intel SGX SDK 2.15+, Occlum library OS, and Linux kernel 5.17+.

About

No description, website, or topics provided.

Resources

License

GPL-2.0, MPL-2.0 licenses found

Licenses found

GPL-2.0
LICENSE-GPL
MPL-2.0
LICENSE-MPL

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Contributors 4

  •  
  •  
  •  
  •  

Languages