Abstract Enclave Identity Abstraction Layer for Multi-Platform Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure computing systems face challenges in simplifying the development of enclave clients and software within enclaves, as they require customization for specific hardware features and lack a unified approach to support multiple native enclave platforms, such as Intel's SGX and Microsoft's VSM.
Innovation Solution
An abstraction model for enclaves is introduced, which includes an abstraction layer that translates communication between enclave clients and native platforms, enabling a single version of enclave software to run on multiple architectures and providing primitives for lifecycle management, attestation, data sealing, and security features like monotonic counters and trusted time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enclave software is customized for specific hardware features, then security and reliability are improved, but device complexity and development difficulty increase
Solution Approach 1:
The patent creates a universal enclave abstraction layer that can interface with multiple different enclave platforms (Intel SGX, Microsoft VSM, and other hardware-based enclave systems). This abstraction layer provides a common interface and translation mechanism, allowing the same enclave software to run across different hardware platforms without customization, thereby reducing development complexity while maintaining security through platform-specific security features.
2Adaptability or versatility
If multiple native enclave platforms are supported, then adaptability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an enclave abstraction layer that acts as an intermediary between the enclave client and multiple native enclave platforms. This abstraction layer translates requests from a unified interface into platform-specific commands, managing the complexity of supporting multiple platforms (Intel SGX, Microsoft VSM, etc.) while presenting a simple, consistent interface to developers. The abstraction layer handles platform-specific security features, memory management, and attestation protocols, thereby improving adaptability without significantly increasing the perceived complexity for end users.
3Ease of operation
If protocol translation is implemented, then ease of operation is improved, but processing time increases
Solution Approach 1:
The enclave abstraction layer performs preliminary actions by pre-compiling and caching translation rules for different enclave platforms. Common request patterns are optimized and stored in advance, allowing the abstraction layer to quickly translate requests without performing full protocol conversion each time. This reduces the time overhead of protocol translation while maintaining ease of operation, as the majority of requests can be handled through cached translation paths rather than full protocol interpretation.
Data Source
AI summary
An abstract enclave identity is presented. An abstract identity may be a secure identity that may be the same for multiple related, but not identical, enclave instantiations. An enclave identity value may be determined from an abstract enclave identity type with respect to a instantiated enclave. Various enclave operations may be performed with an abstract identity, such as sealing data to an abstract identity, incrementing a monotonic counter, making trusted time measurement.