MP-ORAM: A Novel ORAM Design for Multicore Processor Systems

Security becomes increasingly critical in today's ubiquitous computing. One vulnerable part of a computing system is the bus between the processor chip and the external off-chip memory, where data transferred on the bus can be snooped. To protect data confidentiality, encryption is commonly used. However, encryption alone is not sufficient since the adversary can still find out useful information using the memory address trace. Oblivious RAM (ORAM) is a strong security measure to prevent such information leak. ORAM hides a true memory access in a round of random (dummy) accesses to the memory such that the data and addresses transferred over the memory buses look oblivious to the adversary. However, the existing ORAM designs often incur a hefty performance overhead, which greatly slows down the processor execution, especially for the multicore processor system where the potentially high memory access frequency from the multiple cores could make the impact of the performance overhead even more critical. To address this issue, we, for the first time, propose to process multiple memory access requests in a single round of dummy memory accesses. As such, we develop a novel ORAM design, called MP-ORAM, that targets the multicore system and is able to simultaneously handle a dynamic number of memory access requests to mitigate the performance overhead without compromising the obliviousness of the off-chip memory access trace. We have built a prototype for MP-ORAM and successfully integrated it into a RISCV-based multicore processor system. The whole system has also been implemented on a Xilinx Ultrascale+ ZCU102 FPGA board, with which we can effectively evaluate the performance of our design. Our evaluation, based on the SPLASH-2 benchmark suit, shows that MP-ORAM improves performance by 51–157% while only consuming up to 22% extra FPGA resources as compared to the baseline design. Furthermore, from the NIST randomness tests on the memory access traces generated by MP-ORAM, we have demonstrated that this performance improvement does not affect the obliviousness of the memory access trace. Most importantly, MP-ORAM is the first ORAM design of its kind that has been fully implemented and evaluated on a real multicore processor system with OS support.

I. Introduction

Trusted computer hardware is critical to the security of computing systems. One of the most vulnerable parts of the computer hardware is the memory bus between the processor chip and the off-chip memory. The data transferred on the bus can be snooped and the information about the system and the application running on the processor can be leaked through the memory access patterns even if the data have been encrypted, as was demonstrated in [37] and [21]. A promising solution to prevent such an information leak is to use the Oblivious RAM (ORAM) scheme [14], as illustrated in Fig. 1, where data transferred from/to memory are encrypted, and for each memory access requested by the processor, ORAM generates a set of random dummy reads and writes to the off-chip memory. Hence, both the data and the address traces on the memory bus appear random to the adversary and thus no useful information is revealed.