Enabling Low-Cost Secure Computing on Untrusted In-Memory Architectures

Enabling Low-Cost Secure Computing on Untrusted In-Memory Architectures

Speakers: Sahar Ghoflsaz Ghinani, PhD Student, University of California Riverside

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=CIBLGD2frew

Overview

In an era where data processing demands are skyrocketing, Processing-in-Memory (PIM) architectures have emerged as a promising solution to overcome the traditional CPU-memory bottleneck. By integrating computational logic directly into memory modules, PIM systems offer significant performance enhancements, particularly for data-intensive applications like machine learning. However, this paradigm shift introduces a critical security challenge: how to perform computations over sensitive data when it resides in an untrusted memory environment. The talk "Enabling Low-Cost Secure Computing on Untrusted In-Memory Architectures" by Sahar Ghoflsaz Ghinani directly addresses this challenge, proposing a novel framework that combines Trusted Execution Environments (TEEs) with Secure Multi-Party Computation (MPC) to enable secure and efficient computation on PIM.

The core problem stems from the fact that PIM architectures, by design, require sensitive data to be present in plaintext within memory for computation, thus exposing it to various vulnerabilities such as eavesdropping, malicious modification, or cold boot attacks. Existing security solutions like homomorphic encryption impose prohibitive performance overheads, negating PIM's benefits, while redesigning PIM modules to incorporate hardware roots of trust is costly and complex. This research presents a lightweight, practical approach that balances the workload between a TEE and PIM, supporting both linear and nonlinear operations with robust data confidentiality, integrity, and verification, all validated on real-world PIM hardware.

Sahar Ghoflsaz Ghinani, a PhD student at the University of California Riverside, delivers a compelling case for securing PIM without sacrificing its performance advantages. The work is significant because it bridges the gap between high-performance computing and stringent security requirements, making PIM a viable option for processing sensitive data in domains like healthcare, finance, and AI. By demonstrating a practical, low-overhead solution on actual PIM hardware, this research paves the way for wider adoption of PIM in security-sensitive applications, pushing the boundaries of what's possible in secure and efficient data processing.

Background

▶ Watch: Introduction to PIM and its security challenges (0:00)

The increasing demand for high-performance computing, especially for data-intensive applications such as machine learning and data analytics, has highlighted the limitations of traditional von Neumann architectures. The constant data movement between the CPU and off-chip memory (the "memory wall") creates a significant bottleneck. Processing-in-Memory (PIM) architectures aim to alleviate this by bringing computation closer to or directly into memory, thereby reducing data transfer latency and energy consumption. Examples of real-world PIM implementations include Samsung HBM for machine learning accelerators, GSI Gemini for highly parallel data processing, and Samsung Smart SSDs as reconfigurable hardware substrates.

While PIM offers substantial performance benefits, it inherently introduces new security vulnerabilities. In a typical system, Trusted Execution Environments (TEEs) like Intel SGX and ARM TrustZone protect sensitive data and code by isolating them within a secure enclave. However, the standard TEE threat model considers all off-chip components, including conventional DRAM and PIM-enabled memory, as untrusted. This means that if data is moved to PIM for computation, it becomes exposed to various attacks:

• Eavesdropping on the bus: Attackers could snoop on data as it travels between the CPU and PIM.
• Malicious observation or modification: Data residing in untrusted PIM memory could be directly observed or altered by an adversary.
• Cold boot attacks: Information could be retrieved from memory after a power cycle.
• Backdoors: Malicious logic embedded within the PIM-enabled memory could inject faults into computations.

To counter these threats, PIM systems require robust data confidentiality, integrity, and verification schemes. Crucially, these security measures must be lightweight to avoid negating the performance benefits that PIM aims to deliver.

Conventional memory encryption schemes are insufficient because PIM needs to perform computations over the data, not just store it. Several advanced cryptographic techniques have been considered, but each comes with significant drawbacks:

• Homomorphic Encryption (HE): While HE allows computations directly on ciphertext, its high computational complexity and substantial bandwidth requirements result in an alarming three orders of magnitude slowdown compared to an insecure CPU implementation. This effectively cancels out any performance gains from PIM.
• Including PIM in the Trusted Boundary: Redesigning PIM modules to be part of the TEE, incorporating a root of trust and other hardware modifications, would incur significant engineering overhead and cost, hindering widespread adoption.
• Secure Multi-Party Computation (MPC): This approach, which involves splitting computation between different parties such that no single party learns the plaintext data, offers a more promising avenue. The challenge lies in efficiently balancing the workload between the TEE and PIM.

Prior work, specifically SecDP, attempted to address this challenge by securely outsourcing linear computations to PIM. SecDP utilized counter mode encryption, masking plaintext data with one-time paths. The encrypted data (ciphertext) was stored in PIM, while the TEE simultaneously computed over the one-time paths. The results from both were then merged. While SecDP avoided transferring one-time paths from memory to the CPU, it faced several limitations:

• Public Data Overhead: SecDP still required transferring public data to memory for computation, which could become a significant overhead if the amount of public data exceeded private data (e.g., in a GEV kernel with a public matrix and private vector).
• No Nonlinear Computation Support: SecDP was restricted to linear operations, leaving a vast array of common applications (like activation functions in neural networks) unsecured.
• Simulation-Based: The scheme was evaluated primarily through simulation, lacking validation on real-world PIM hardware.

These limitations highlight the need for a more comprehensive and practical secure PIM solution that supports diverse computations, minimizes overhead, and is validated on actual hardware platforms.

Key Findings

▶ Watch: Adopting Secure Multi-Party Computing (MPC) for PIM (4:20)

The presented work addresses the critical shortcomings of prior approaches by introducing a novel, multi-faceted scheme for secure PIM computation. The key findings and contributions are:

• Balanced Workload Distribution: The proposed model effectively balances computation between the Trusted Execution Environment (TEE) and the PIM using a refined Secure Multi-Party Computation (MPC) strategy. This ensures that the CPU (within the TEE) handles compute-intensive tasks, while the PIM handles memory-intensive portions, optimizing overall performance.
• Reduced TEE Overhead via Precomputation: A significant innovation is the adoption of precomputation on the TEE whenever possible. By performing parts of the kernel computation on the one-time paths within the TEE before runtime, the scheme drastically reduces the CPU overhead during the actual computation phase.
• Support for Nonlinear Operations: Unlike previous work, this scheme extends security to nonlinear computations. This is achieved by dynamically switching to Yao's garbled sharing (a form of MPC) for nonlinear functions, enabling secure execution of complex operations like activation functions directly on the PIM.
• Real-World Hardware Validation: The scheme is not merely theoretical or simulation-based; it has been implemented and rigorously evaluated using real-world PIM hardware, specifically 20 OPAM PIMs, which provide access to over 2,000 DPUs and 160 GB of memory. This validation on actual hardware demonstrates its practical viability and effectiveness.
• Low-Overhead Security and Verification: The proposed method achieves low-overhead data confidentiality, integrity, and verification for both linear and nonlinear operations. The verification mechanism, based on linear checksums and Message Authentication Codes (MACs), adds negligible overhead to the overall execution time.
• Significant Performance Gains: Benchmarking against secure CPU implementations shows substantial speedups, with the proposed OPAM Secure scheme achieving up to 15 times speedup over CPU Secure. Furthermore, it demonstrated minimal performance overhead compared to an insecure OPAM implementation, proving that security can be integrated without sacrificing PIM's core performance advantages.

These findings collectively represent a significant step forward in enabling practical, secure, and high-performance computing on untrusted PIM architectures, addressing a long-standing challenge in memory-centric computing.

Technical Deep Dive

▶ Watch: Challenges with previous PIM security approach (SecPIM-DP) (7:00)

The proposed secure PIM computing scheme is meticulously designed to provide robust confidentiality, integrity, and verification with minimal overhead. It operates within a system equipped with both standard memory (where data initially resides) and PIM-enabled memory. The scheme can be broken down into an initialization phase, a precomputation phase, a runtime phase, and a verification mechanism.

High-Level Security Scheme

1. Data Encryption (Initialization):

• Before any computation begins, the sensitive plaintext data is brought from standard memory into the Trusted Execution Environment (TEE).
• Inside the TEE, the data is decrypted (if previously encrypted) and then masked with one-time paths using counter mode encryption. This process generates the ciphertext.
• This ciphertext is then stored back into the standard memory, ready for use in subsequent computations. The TEE holds the corresponding one-time paths or the keys to generate them on the fly.

1. Precomputation (TEE-Side):

• Whenever feasible, the system performs a precomputation stage. In this stage, the kernel computation (or a portion of it) is executed on the one-time paths directly within the TEE.
• The partial results derived from this TEE-side precomputation are then securely stored in standard memory, awaiting combination with PIM's results. This strategy significantly reduces the computational burden on the TEE during runtime.
• If precomputation is not supported for a particular operation, the TEE performs its share of the computation in parallel with the PIM during the runtime phase.

1. Runtime (PIM-Side):

• During runtime, the ciphertext (from standard memory) is offloaded to the PIM-enabled memory.
• The PIM then performs the designated computation over this ciphertext. Because the data is encrypted, the PIM, considered untrusted, never sees the plaintext.

1. Result Merging:

• Once the PIM completes its computation, its partial results (still in ciphertext form or derived from ciphertext) are retrieved back to the TEE.
• Simultaneously, the TEE decrypts its own precomputed partial results (if precomputation was used).
• Both sets of partial results (from PIM and TEE) are then merged within the TEE to yield the final, correct plaintext result of the computation.

Handling Nonlinear Functions

A crucial enhancement of this scheme over prior work is its ability to support nonlinear computations. This is achieved by dynamically switching the MPC protocol:

• After the initial linear portions of a computation are completed using the counter mode encryption and one-time path masking, if a nonlinear function (e.g., a sigmoid activation in a neural network) is required, the system transitions to Yao's garbled sharing.
• A garbled circuit specifically for the nonlinear function is generated on the TEE. This garbled circuit is then securely shared with the PIM.
• Both the TEE and the PIM input their respective encrypted shares of the data into the garbled circuit. The garbled circuit allows them to compute the nonlinear function collaboratively without either party learning the other's input or the final plaintext output, only the garbled result.
• Once the nonlinear computation is complete, the system can revert to the counter mode encryption scheme for any subsequent linear operations, followed by the standard merging of results on the TEE.

Verification Scheme

To ensure the integrity of the computation performed on the untrusted PIM, a lightweight verification scheme is integrated using Message Authentication Codes (MACs).

• For each block of plaintext data, a linear checksum is computed, generating a unique tag.
• These tags are then masked with their own set of one-time paths, effectively creating ciphertext for the tags.
• From this point, these "ciphertext tags" are treated identically to the data's ciphertext. They are offloaded to the PIM, subjected to the same computations, and their partial results are merged within the TEE.
• The final merged tag on the TEE is then used to verify the integrity of the PIM's computation. Any discrepancy indicates a fault injection or malicious modification by the untrusted PIM. The overhead of this verification scheme was found to be negligible across all evaluated applications.

This comprehensive technical framework ensures that sensitive data processed by PIM architectures remains confidential and untampered, while preserving the performance benefits of in-memory computing.

Demo / Proof of Concept

▶ Watch: Overview of proposed secure PIM computing model (8:45)

The efficacy and practicality of the proposed secure PIM scheme were rigorously demonstrated through an implementation and evaluation on real-world hardware. The experimental setup utilized 20 OPAM PIMs, which collectively provide access to more than 2,000 DPUs (Data Processing Units) and a substantial 160 GB of memory. This robust platform allowed for realistic assessment of the scheme's performance and overhead.

The evaluation focused on several data-intensive applications commonly used in machine learning and data analytics: Multi-Layer Perceptron (MLP), Deep Learning Recommendation Model (DLRM), Logistic Regression, and Linear Regression. The talk provided detailed insights into the results for MLP and Logistic Regression, with the full findings available in the accompanying paper.

The performance of the proposed scheme (OPAM Secure) was benchmarked against three baselines:

1. CPU Insecure: An insecure implementation of the application running solely on a CPU.
2. CPU Secure: A TEE-based (specifically, VM-based TEEs) secure implementation running on a CPU.
3. OPAM Insecure: An insecure implementation of the application running on OPAM PIMs without any security considerations.

MLP Results:

• For CPU Secure, using VM-based TEEs introduced minimal overhead compared to CPU Insecure, indicating efficient TEE integration.
• Offloading computation to OPAM PIMs (even insecurely) resulted in significant execution time reduction, particularly for larger datasets, confirming PIM's inherent performance advantage.
• The OPAM Secure implementation achieved an impressive up to 15 times speedup over CPU Secure. This highlights the substantial performance gains realized by combining TEEs with PIM and the proposed secure computation scheme.
• Crucially, OPAM Secure demonstrated minimal performance overhead compared to OPAM Insecure. This indicates that the security mechanisms (MPC, precomputation, encryption) were highly optimized and did not significantly impede PIM's raw processing power.
• The talk noted that a "runtime scheme" (implying the OPAM Secure version without the precomputation stage) did not yield significant performance benefits when a large amount of public data was involved, underscoring the importance of the precomputation stage in managing public data overhead.
• The verification scheme (using linear checksums and MACs) was found to incur negligible overhead across all applications, affirming its lightweight design.

Logistic Regression Results:

• Similar performance patterns were observed for Logistic Regression.
• For activation functions, two different implementations were considered for OPAM Insecure: a LUT-based (Look-Up Table) version and a non-LUT based version.
• The OPAM Secure scheme was evaluated in two variants:
• OPAM Secure A: Only linear computations were offloaded to PIM.
• OPAM Secure A2Y: Both linear and nonlinear computations (using Yao's garbled sharing for the nonlinear part) were offloaded to PIM.
• Performing nonlinear functions directly on the PIM (closer to the data), as in OPAM Secure A2Y, consistently yielded better execution times, validating the effectiveness of integrating nonlinear support.
• Overall, OPAM Secure achieved a 5 times speedup compared to CPU Secure for logistic regression.
• When comparing to OPAM Insecure, the results showed nuance:
• OPAM Secure experienced a 6 times slowdown compared to OPAM Insecure when using the LUT-based implementation for the activation function. This is expected, as adding security layers will naturally introduce some overhead compared to a completely insecure, highly optimized (LUT-based) baseline.
• However, remarkably, OPAM Secure achieved a 4 times speedup compared to OPAM Insecure when using the non-LUT based implementation of the activation function on the PIM. This specific finding is particularly significant. It suggests that for certain PIM-based operations (like non-LUT activation functions) where the insecure baseline might be suboptimally implemented or inherently inefficient, the proposed secure scheme, with its optimized workload balancing and specialized handling of nonlinearities, can actually outperform an insecure PIM approach. This underscores the potential for well-designed secure protocols to not only protect data but also to guide more efficient computational strategies on novel hardware.

The comprehensive evaluation on OPAM PIMs unequivocally demonstrates that the proposed scheme is capable of delivering high-performance, secure computing on untrusted in-memory architectures with minimal and, in some cases, even positive performance impact compared to insecure PIM baselines.

Defensive Implications

▶ Watch: High-level explanation of the secure computation scheme (10:00)

The technical advancements presented in this talk have profound implications for defenders and organizations looking to leverage the performance benefits of PIM while maintaining robust security postures. The ability to perform secure computations on untrusted in-memory architectures opens new avenues for protecting sensitive data in high-performance environments.

Firstly, for enterprises considering or already deploying Processing-in-Memory (PIM) technologies, this research provides a practical and validated framework for secure adoption. Traditionally, the security risks associated with exposing plaintext data in PIM have been a major deterrent for handling sensitive information. This scheme directly addresses these concerns, enabling organizations to process confidential data (e.g., patient records in healthcare, financial transactions, proprietary machine learning models) on PIM without fear of eavesdropping, malicious modification, or data leakage through cold boot attacks or backdoors.

Secondly, the scheme's comprehensive approach, combining Trusted Execution Environments (TEEs), Secure Multi-Party Computation (MPC), and precomputation, offers a multi-layered defense. Defenders can be confident that data confidentiality is maintained through encryption and one-time paths, while integrity is ensured via Message Authentication Codes (MACs) and linear checksums. This means that even if an attacker gains control over the PIM hardware, they cannot extract meaningful plaintext data or tamper with computation results undetected.

Furthermore, the support for both linear and nonlinear operations, especially through the integration of Yao's garbled sharing, is crucial for modern workloads. Machine learning applications, which are a primary driver for PIM adoption, heavily rely on nonlinear activation functions. This work ensures that the entire ML pipeline, from data preprocessing to model inference, can be run securely on PIM, protecting valuable intellectual property and sensitive input data.

The negligible overhead of the verification scheme is particularly beneficial. Security often comes at a performance cost, but this research demonstrates that robust integrity checks can be implemented without significantly impacting the speed advantages of PIM. This allows defenders to enforce strong data integrity policies without having to make difficult trade-offs between security and performance.

Finally, the validation on real-world PIM hardware (OPAM) provides a strong foundation for future hardware and software co-design efforts. This research can guide PIM architects in designing future generations of PIM devices that intrinsically support these secure computation paradigms, potentially by integrating specific cryptographic primitives or MPC accelerators directly into the memory fabric. For software developers, it provides a blueprint for building secure applications that can fully exploit PIM capabilities.

In essence, this work equips defenders with the knowledge and techniques to unlock the full potential of PIM for secure data processing, transforming a performance-centric technology into a secure computing platform for even the most sensitive workloads.

Key Takeaways

• PIM Benefits Can Be Secured: It is possible to realize the significant performance advantages of Processing-in-Memory (PIM) architectures without compromising the confidentiality and integrity of sensitive data, even on untrusted memory components.
• Hybrid MPC for Workload Balancing: A hybrid approach combining Trusted Execution Environments (TEEs) with PIM using Secure Multi-Party Computation (MPC) and TEE-side precomputation effectively balances computational workload, offloading memory-intensive tasks to PIM and compute-intensive tasks (or precomputation) to the TEE.
• Comprehensive Operation Support: The proposed scheme supports both linear and, crucially, nonlinear operations, making it suitable for a wide range of modern data-intensive applications, including complex machine learning models.
• Yao's Garbled Sharing for Nonlinearity: Dynamic switching to Yao's garbled sharing protocol is an effective strategy for securely executing nonlinear functions on PIM, maintaining privacy while enabling complex computations.
• Real-World Validation is Key: The successful implementation and evaluation on real-world OPAM PIM hardware demonstrate the practical viability and efficiency of the proposed secure computing framework, moving beyond theoretical simulations.
• Low-Overhead Verification: A lightweight verification scheme based on linear checksums and Message Authentication Codes (MACs) ensures computation integrity with negligible performance overhead, adding a critical layer of trust to PIM operations.
• Significant Performance Gains: The OPAM Secure scheme achieves up to 15 times speedup over secure CPU implementations and, in some specific cases (e.g., non-LUT based activation functions), can even outperform insecure PIM baselines, showcasing the power of optimized secure designs.

About the Speaker(s)

Sahar Ghoflsaz Ghinani is a PhD student at the University of California Riverside. Her research focuses on enabling secure computing on novel hardware architectures, particularly in the context of Processing-in-Memory (PIM) systems. This work, presented at USENIX Security, highlights her expertise in bridging the gap between high-performance computing and robust security solutions.