hesela.devIceClave
IceClave is a research trusted execution environment that isolates offloaded SSD programs from flash-management code and other in-storage programs.
The design exposes cached address mappings read-only in a protected region, while keeping FTL updates and runtime metadata in the secure world. Reading a mapping does not authorize flash access: a dedicated permission-checking process gates requests using per-entry program identities. [1]
A missing cached mapping still redirects translation to the FTL in the secure world. The optimization avoids some transitions, not all mapping work. [1]
The study combines a gem5/SimpleSSD/USIMM simulator with an OpenSSD Cosmos+ prototype for selected core functions; these are different evidence sources, not a commercial-device certification. [1]
Relations
Limitations
- The threat model trusts device vendors and assumes secure program delivery; software side-channel attacks are excluded. [2]
Citations
- Kang et al. IceClave: A Trusted Execution Environment for In-Storage Computing. MICRO 2021, pp. 199-211, sections 3-6; DOI 10.1145/3466752.3480109.
- Xue et al. Building A Trusted Execution Environment for In-Storage Computing. Author follow-up, arXiv:2205.06361v1, sections 2-3 (2022).
Sources & caveats
- Primary-source synthesis, not an executed prototype, hardware security audit or reproduced performance result.