Enclave Data Sealing Abstraction Across Platforms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current secure computing systems face challenges in simplifying the development and management of enclave clients and software across different native enclave platforms, such as Intel's SGX and Microsoft's VSM, due to architectural differences, which complicates the process of instantiating enclaves, attesting their integrity, and securely transferring data and code within and outside the enclaves.
Innovation Solution
An abstraction model and layer are introduced to unify native enclave platform architectures, enabling a single version of enclave software to run on multiple platforms by translating communication protocols and providing primitives for enclave lifecycle management, attestation, data sealing, and security features like monotonic counters and trusted time, along with an abstract identity hierarchy for secure data sealing and attestation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single enclave software version is developed to run on multiple native enclave platforms, then software adaptability and ease of manufacture are improved, but device complexity increases due to the need to handle architectural differences across platforms
Solution Approach 1:
The patent introduces an intermediary layer (abstraction layer or translation layer) between the enclave software and multiple native enclave platforms. This intermediary handles protocol translation and architectural differences, allowing a single software version to operate across diverse platforms without directly managing platform-specific complexities.
Solution Approach 2:
The enclave software is designed with universal interface definitions that can work across multiple native platforms. By defining platform-agnostic communication protocols and data structures, the software achieves multi-functionality and broad adaptability while maintaining a single codebase.
2Ease of operation
If platform-specific enclave implementations are used for each native enclave platform, then ease of operation is improved, but software adaptability deteriorates requiring tailored versions for each platform
Solution Approach 1:
Instead of creating separate tailored versions of enclave software for each native platform, the patent uses a copying approach where a single validated software version is replicated and deployed across multiple platforms. The intermediary layer ensures that this copied software maintains compatibility and functionality across different architectural environments.
3Reliability
If strict isolation and security restrictions are enforced in enclaves, then security is improved, but ease of operation deteriorates due to limitations on reading from or writing to enclave memory
Solution Approach 1:
The patent segments memory access control into different levels and types. Rather than enforcing uniform strict isolation, the system implements fine-grained access controls that allow specific memory regions to be accessed under defined conditions. This segmentation enables both security enforcement and operational flexibility for legitimate access patterns.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for securely sealing and unsealing enclave data across platforms are presented. Enclave data from a source enclave hosted on a first computer may be securely sealed to a sealing enclave on a second computer, and may further be securely unsealed for a destination enclave on a third computer. Securely transferring an enclave workload from one computer to another is disclosed.