Abstract
Intel Software Guard Extensions (SGX) protects user software from malware by maintaining the confidentiality and integrity of the software executed in secure enclaves on random access memory. However, the confidentiality of its stored executable is not guaranteed. Therefore, secret information, e.g. user keys, should be provided to the enclaves via appropriate secure channels. Although one of the solutions is to use remote attestation function of SGX, there is a potential risk that user keys are exposed to malicious insiders at the service provider of remote attestation. In this paper, we propose a novel and secure framework for user-key provisioning to SGX enclaves. Our framework utilizes sealing function of SGX, and consists of two phases: the provisioning phase and the operation phase. In the provisioning phase, a user key is encrypted by sealing function, and it is stored in storage. Our assumption is that this phase is performed in a secure environment. In the operation phase, the encrypted blob is read from the storage and decrypted. Then, SGX applications can use the user key without exposing it to attackers. We implemented a prototype of our framework using a commercial Intel CPU and evaluated its feasibility.
The preliminary version of this paper was presented in the poster session of the 39th IEEE Symposium on Security and Privacy.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
The integrity of the executable is maintained with a certificate attached to the executable.
- 2.
The public key is essentially used for detecting forgeries of executables.
References
Anati, I., Gueron, S., Johnson, S., Scarlata, V.: Innovative technology for CPU based attestation and sealing. Intel Corporation, White Paper, 14 August 2013
Baumann, A., Peinado, M., Hunt, G.C.: Shielding applications from an untrusted cloud with Haven. In: OSDI 2014, pp. 267–283 (2014)
Hoekstra, M., Lal, R., Pappachan, P., Phegade, V., del Cuvillo, J.: Using innovative instructions to create trustworthy software solutions. Intel Corporation, White Paper, 14 August 2013
Kaplan, D.: AMD x86 memory encryption technologies. LSS 2016, Linux Foundation Events (2016)
Kaplan, D., Powell, J., Woller, T.: AMD memory encryption. Advanced Micro Devices (AMD), White Paper, 21 April 2016
Kaplan, D., Woller, T., Powell, J.: AMD memory encryption tutorial. In: ISCA 2016, Tutorial (2016)
Karande, V., Bauman, E., Lin, Z., Khan, L.: SGX-log: securing system logs with SGX. In: AsiaCCS 2017, pp. 19–30 (2017)
McKeen, F., Alexandrovich, I., Berenzon, A., Rozas, C.V., Shafi, H., Shanbhogue, V., Savagaonkar, U.R.: Innovative instructions and software model for isolated execution. Intel Corporation, White Paper, 14 August 2013
Priebe, C., Vaswani, K., Costa, M.: EnclaveDB: a secure database using SGX. In: S&P 2018, pp. 264–278 (2018)
Schuster, F., Costa, M., Fournet, C., Gkantsidis, C., Peinado, M., Mainar-Ruiz, G., Russinovich, M.: VC3: trustworthy data analytics in the Cloud using SGX. In: S&P 2015, pp. 38–54 (2015)
Shepherd, C., Akram, R.N., Markantonakis, K.: Towards trusted execution of multi-modal continuous authentication schemes. In: SAC 2017, pp. 1444–1451 (2017)
Silva, L.V., Marinho, R., Vivas, J.L., Brito, A.: Security and privacy preserving data aggregation in cloud computing. In: SAC 2017, pp. 1732–1738 (2017)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Machida, T., Yamamoto, D., Morikawa, I., Kokubo, H., Kojima, H. (2019). A Secure Framework for User-Key Provisioning to SGX Enclaves. In: Barolli, L., Kryvinska, N., Enokido, T., Takizawa, M. (eds) Advances in Network-Based Information Systems. NBiS 2018. Lecture Notes on Data Engineering and Communications Technologies, vol 22. Springer, Cham. https://doi.org/10.1007/978-3-319-98530-5_63
Download citation
DOI: https://doi.org/10.1007/978-3-319-98530-5_63
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-98529-9
Online ISBN: 978-3-319-98530-5
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)