This is the repository for MPKLink, a project designed to benchmark the performance of Intel MPK as a tool for maintaining isolation between two same-machine microservices communicating via shared memory. This project was created for CS 239: Efficient Cryptography-Based Systems at UCLA in Fall 2024 by Salma Alandary and Benson Liu under the supervision of Professor Sam Kumar. For any questions or additional information about this project, please contact the authors
When multiple microservices are co-located on the same machine, one common optimization is to take advantage of shared memory for communication. Shared memory allows different processes to access a common memory region, leading to faster data transfer compared to traditional network-based methods. However, shared memory primitives introduce several challenges, including a lack of fine-grained access control, synchronization overhead, and copying overhead. Fine-grained access control is necessary to ensure that only authorized processes can read from or write to specific memory regions, while synchronization overhead arises when processes must coordinate access to prevent race conditions. Additionally, many shared memory systems require copying data between different buffers, further increasing the overhead. Intel Memory Protection Keys (MPK) provide a hardware-backed solution to these problems by enabling processes to control access to memory pages with fine-grained protection keys, thus reducing the need for complex synchronization mechanisms and eliminating unnecessary data copying. In response to these challenges, we propose MPKLink, a system that enables performant and trustworthy communication between microservices hosted on the same machine. MPKLink provides a framework for making small modifications to microservice orchestration software like Docker Compose and a gRPC compiler, allowing microservices to communicate securely via Intel MPK with minimal changes to their existing codebase. To assess its effectiveness, we benchmarked various inter-process communication (IPC) primitives, including OS pipes, Unix domain sockets, shared memory, and Intel MPK, comparing their performance and highlighting the advantages of using Intel MPK for high-performance, secure inter-service communication. After evaluating MPKLink against communication methods such as OS pipes, Unix domain sockets, and shared memory, we concluded that while it performs comparably to or better than at least one of these IPC methods for smaller-scale communications, it faces challenges with larger reads and writes. Although MPKLink is consistently slower than a bare shared memory implementation, it offers stronger isolation guarantees, making it more suitable for threat models requiring higher security. We believe that the efficiency of MPKLink can be further improved by optimizing shared memory spinlocks to use atomic variables, allowing each thread to modify its Protection Key Rights for User pages (PKRU) register at appropriate times. Additionally, identifying and eliminating unnecessary memory copying could reduce overhead. While these enhancements may not enable MPKLink to outperform Unix domain sockets or OS pipes for large data transfers, they present promising research directions for applications with smaller-scale or high-frequency inter-service communication. By addressing these limitations, MPKLink has the potential to become a more versatile and efficient solution for secure microservice communication. We have no external collaborators, aren't using the project for another class, and started the project this quarter.