Abstract
Intel Software Guard Extensions (SGX) protects user software from malware by maintaining the confidentiality and integrity of the software executed in secure enclaves on random access memory. However, the confidentiality of its stored executable is not guaranteed. Therefore, secret information, e.g. user keys, should be provided to the enclaves via appropriate secure channels. Although one of the solutions is to use remote attestation function of SGX, there is a potential risk that user keys are exposed to malicious insiders at the service provider of remote attestation. In this paper, we propose a novel and secure framework for user-key provisioning to SGX enclaves. Our framework utilizes sealing function of SGX, and consists of two phases: the provisioning phase and the operation phase. In the provisioning phase, a user key is encrypted by sealing function, and it is stored in storage. Our assumption is that this phase is performed in a secure environment. In the operation phase, the encrypted blob is read from the storage and decrypted. Then, SGX applications can use the user key without exposing it to attackers. We implemented a prototype of our framework using a commercial Intel CPU and evaluated its feasibility.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.