Shulou(Shulou.com)11/24 Report--

CTOnews.com December 12 news, Ant Group led the open source trusted execution environment (TEE) open source operating system Occlum v1.0 was officially released. This version has higher stability and completeness than previous versions, with up to five times significant performance improvements in thread scheduling, network, and storage IO. Version v1.0 also launched the Spark big data analysis solution jointly developed by Ant Group and Intel for the first time, which can help Spark users seamlessly migrate to the TEE secret computing environment.

Occlum is an open source operating system in memory security and multi-task user mode for a variety of TEE, which can make the application load easily deployed in TEE to ensure the confidentiality and integrity of user privacy data in the whole computing process. At present, the TEE that Occlum can support include Intel SGX and domestic TEE-HyperEnclave independently developed by Ant Group.

Occlum is a secure and efficient multitasking user mode operating system implemented in a single Enclave on Intel SGX. Because Occlum adopts the scheme of implementing LibOS in a single Enclave, Occlum is superior to other LibOS implementation schemes in terms of resource consumption and running efficiency.

In 2021, Ant Group decided to donate Occlum to the Linux Foundation Confidential Computing Alliance CCC,Occlum, which has been developed and polished for 4 years today. It has released more than 40 versions in the open source community and obtained more than 1000 Github Star.

Here are the highlights of Occlum v1.0

1) support more than 150 Linux-compatible system calls

In order to seamlessly migrate Linux native applications to Enclave without modification and compilation, more than 150 Linux-compatible system calls have been implemented in Occlum v1.0. Supports most mainstream programming languages, including C / C++, Java, Python, Golang, Rust, shell scripts and so on. At the same time, many Linux applications are provided in Occlum open source repository, such as SQLite TensorFlow, OpenVino, PyTorch, Redis, MySQL, Spark, Flink and so on. It is a Demo demonstration of how to run on Occlum, and a reference implementation scheme for deploying scalable Occlum-based security reasoning cases on K8S.

2) easy to use, efficient, practical and safe

First of all, in terms of ease of use, Occlum is used in a way that is similar to the experience of containers. Users can deploy the application to TEE with a few simple commands.

The second feature is high efficiency. Occlum is a high-performance multitasking system that supports multiple processes. It uses a single address space architecture, so multiple processes share the same Enclave, so Occlum can quickly complete process startup and inter-process communication in TEE.

The third feature is practical. Occlum supports a variety of file systems, such as encrypted file system, memory file system, etc., which can meet the various file I / O requirements of the application, and can transparently encrypt the data stored on disk when the application is running.

The fourth feature is memory security. Occlum is the first LibOS written in the memory security language Rust in the industry. Rust is a programming language that pursues memory security without additional performance loss. Occlum written in Rust language can eliminate low-level memory security errors, thus improving the security of the overall kernel code of Occlum, and is more reliable when hosting security-critical applications.

3) introduce four core technologies to make the application load of running users more efficient

First of all, Occlum v1.0 puts forward the design idea of taking asynchronism as the center, redesigns the whole Occlum code architecture, uses the asynchronous characteristics of Rust language, and implements an efficient thread scheduling mechanism in Enclave based on Rust lightweight protocol and asynchronous runtime, especially for large applications such as machine learning and distributed choreography.

Secondly, Occlum v1.0 innovatively introduces io_uring, a new generation of Linux asynchronous I / O operation interface, and supports most IO operations (including network IO / disk IO). Using this new feature, coupled with Rust asynchronous operation, Occlum has network IO performance close to Linux native.

Third, Occlum v1.0 absorbs the new generation of trusted virtual block devices based on log structure independently developed by Ant Group, which can make the existing mainstream file systems have the security protection ability of disk I / O, which is higher than that of various existing file I / O or disk I / O protection schemes in Linux kernel, but also higher than similar TEE protection schemes such as SGX-PFS. Because the trusted virtual block device adopts a brand-new additional write log structure design, the performance of IO will also be greatly improved.

Fourth, Occlum v1.0 adopts a dynamic memory management design based on on-demand allocation, which not only improves the utilization of Enclave physical memory, but also greatly shortens the time for applications to be loaded into TEE.

Compare Occlum v1.0 with the previous community version 0.29 performance test data. You can see that the thread scheduling performance of Occlum v1.0 is five times higher than that of the previous version, and the greater the number of application threads, the more obvious the advantages of v1.0 scheduling performance. Compared with the previous version, the network transmission speed and file IO throughput are also improved by 2 and 3 times, especially on the network IO, which can be close to the original network transmission speed of Linux in the same environment.

4) the Spark big data analysis scheme jointly developed by Ant Group and Intel for the first time

Ant Group and Intel BigDL team work together to run Apache Spark distributed big data processing applications in Occlum. Based on this capability, Ant Group and Intel team jointly released the "end-to-end secure distributed Spark big data Analysis Scheme based on Occlum and BigDL", which has also been launched in Occlum v1.0.

Compared with the existing Spark on SGX solutions in the industry, this scheme not only supports a variety of deployment models, but also makes up for the shortcomings of the existing schemes in terms of Spark capability support.

Through the secure running environment provided by Occlum, a distributed privacy protection machine learning platform (PPML) is built based on BigDL, which can protect end-to-end (including data input, data analysis, machine learning, deep learning and other stages) of distributed artificial intelligence applications. Different from the traditional privacy computing framework, this scheme provides an environment in which standard big data applications can be run, hoping to help existing big data / distributed applications seamlessly migrate to an end-to-end secure environment. and strengthen the security of each link.

Through the Spark in Occlum capability, existing Spark applications can be run directly into the TEE environment without any code modification, and can be expanded horizontally according to the data scale, thus easily supporting the data scale at the TB level. On the other hand, the remote proof function, which is responsible for integrity, is also imperceptibly added to the whole process. Application developers do not need to explicitly add the remote proof code to realize the remote proof and verification of instances through the remote proof function provided by Occlum and BigDL. The solution has been launched on the Microsoft Azure Secret Computing blog channel, and it is also open source.

CTOnews.com learned that with the development of the current TEE hardware architecture, in order to meet more security requirements in different computing scenarios, Occlum will support GPU TEE and extend the TEE security capabilities provided by CPU to GPU to ensure that data can be safely transferred to more powerful computing hardware devices.

Occlum is also preparing for the next generation of TEE TDX that Intel will bring next year, and Occlum plans to evolve from a user-mode operating system to a kernel-based operating system.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.