Software Guard Extensions Technology Research Articles

A secure double spectrum auction scheme

With the arrival of the 5G era, wireless communication technologies and services are rapidly exhausting the limited spectrum resources. Spectrum auctions came into being, which can effectively utilize spectrum resources. Because of the complexity of the electronic spectrum auction network environment, the security of spectrum auction can not be guaranteed. Most scholars focus on researching the security of the single-sided auctions, while ignoring the practical scenario of a secure double spectrum auction where participants are composed of multiple sellers and buyers. Researchers begin to design the secure double spectrum auction mechanisms, in which two semi-honest agents are introduced to finish the spectrum auction rules. But these two agents may collude with each other or be bribed by buyers and sellers, which may create security risks, therefore, a secure double spectrum auction is proposed in this paper. Unlike traditional secure double spectrum auctions, the spectrum auction server with Software Guard Extensions (SGX) component is used in this paper, which is an Ethereum blockchain platform that performs spectrum auctions. A secure double spectrum protocol is also designed, using SGX technology and cryptographic tools such as Paillier cryptosystem, stealth address technology and one-time ring signatures to well protect the private information of spectrum auctions. In addition, the smart contracts provided by the Ethereum blockchain platform are executed to assist offline verification, and to verify important spectrum auction information to ensure the fairness and impartiality of spectrum auctions. Finally, security analysis and performance evaluation of our protocol are discussed.

A Blockchain-Based and SGX-Enabled Access Control Framework for IoT

With the rapid development of physical networks, tens of billions of Internet of Things (IoT) devices have been deployed worldwide. Access control is essential in the IoT system, which manages user access to vital IoT data. However, access control for the IoT is mainly based on centralized trusted servers, which face problems such as a single point of failure and data leakage. To tackle these challenges, we propose an access control framework for the IoT by combining blockchain and Intel software guard extension (SGX) technology. A blockchain validates both IoT devices and edge servers added to the network. The access control contract is deployed on the blockchain, which can manage attribute-based access control policies in a fine-grained manner and make access control decisions flexibly. SGX technology is introduced into the edge computing server to realize the confidentiality of data processing. Finally, we implemented the prototype of the framework on Quorum and conducted extensive experiments and theoretical analyses on the performance of the blockchain. The results of the experimental tests and theoretical analyses show that our framework has more advantages in computing costs and on-chain storage costs.

Design and Implementation of Virtual Security Function Based on Multiple Enclaves

Network function virtualization (NFV) provides flexible and scalable network function for the emerging platform, such as the cloud computing, edge computing, and IoT platforms, while it faces more security challenges, such as tampering with network policies and leaking sensitive processing states, due to running in a shared open environment and lacking the protection of proprietary hardware. Currently, Intel® Software Guard Extensions (SGX) provides a promising way to build a secure and trusted VNF (virtual network function) by isolating VNF or sensitive data into an enclave. However, directly placing multiple VNFs in a single enclave will lose the scalability advantage of NFV. This paper combines SGX and click technology to design the virtual security function architecture based on multiple enclaves. In our design, the sensitive modules of a VNF are put into different enclaves and communicate by local attestation. The system can freely combine these modules according to user requirements, and increase the scalability of the system while protecting its running state security. In addition, we design a new hot-swapping scheme to enable the system to dynamically modify the configuration function at runtime, so that the original VNFs do not need to stop when the function of VNFs is modified. We implement an IDS (intrusion detection system) based on our architecture to verify the feasibility of our system and evaluate its performance. The results show that the overhead introduced by the system architecture is within an acceptable range.

When Blockchain Meets SGX: An Overview, Challenges, and Open Issues

As a decentralized, public, and digital ledger technology in Peer-to-Peer network, blockchain has received much attention from various fields, including finance, healthcare, supply chain, etc. However, some challenges (e.g., scalability, privacy, and security issues) severely affects the wide adoption of blockchain technology. Recently, Intel software guard extensions (SGX), as new trusted computing technologies, have provided a new solution to the above challenges in the blockchain area. Although many studies have focused on using SGX technology to enhance their schemes in the blockchain areas, no comprehensive survey has systematically analyzed and delineated these studies. This article is the first to systematically discuss the application status of SGX in the blockchain area. In this article, we study the scheme designs, advantages, and disadvantages of the existing works using a six-layer hierarchical structure of the blockchain. We also summarize the functions of SGX and formally analyze the advantages and disadvantages of SGX. Finally, we review the remaining challenges and present a list of possible directions for future research.