Enclave Data Sealing Abstraction Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure computing systems face challenges in simplifying the development of enclave clients and software that run inside enclaves, as they require customization for specific hardware features and lack abstraction across different enclave platforms like Intel's SGX and Microsoft's VSM, limiting interoperability and scalability.
Innovation Solution
An abstraction model for enclaves is introduced, which simplifies development by providing a unified interface and abstraction layer that translates communication between enclave clients and native platforms, enabling a single version of software to run on multiple architectures, including SGX and VSM, and abstracting enclave identity for secure data sealing and attestation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enclave clients are customized for specific hardware features, then security and compatibility with native platforms is improved, but device complexity and development difficulty increase
Solution Approach 1:
The patent introduces an abstraction layer as an intermediary between enclave clients and native platforms. This abstraction layer handles hardware-specific details and translates them into unified interface calls, allowing clients to remain platform-agnostic while maintaining security and compatibility with different hardware architectures.
Solution Approach 2:
The patent creates a universal enclave client interface that can operate across multiple native platforms (Intel SGX, Microsoft VSM, AMD SEV) without requiring separate customizations. The unified interface provides multi-functional capability that works on different hardware architectures through the abstraction layer.
2Productivity
If software is customized for each enclave platform, then platform-specific optimization is improved, but adaptability and interoperability deteriorate
Solution Approach 1:
The abstraction layer serves as a mediator that allows platform-optimized native enclave implementations to coexist with a unified client interface. The abstraction layer translates unified interface calls into platform-specific optimizations, maintaining both interoperability and performance optimization.
Solution Approach 2:
The patent segments the system into two distinct layers: a unified client interface layer and a platform-specific implementation layer. This segmentation allows each layer to be optimized independently - the client layer for interoperability and the native layer for platform-specific performance - while maintaining clear boundaries through the abstraction layer.
3Adaptability or versatility
If multiple enclave platforms are supported, then adaptability and scalability are improved, but device complexity and system complexity increase
Solution Approach 1:
The patent implements a universal enclave client interface that provides multi-functional capability across different platforms. The unified interface handles multiple platform types through a single consistent API, enabling cross-platform capability without requiring clients to understand platform-specific complexities.
Solution Approach 2:
The abstraction layer acts as a mediator that centralizes platform complexity management. By consolidating platform-specific details in the abstraction layer, the patent reduces system complexity from the client's perspective while maintaining support for multiple enclave platforms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for securely sealing and unsealing enclave data across platforms are presented. Enclave data from a source enclave hosted on a first computer may be securely sealed to a sealing enclave on a second computer, and may further be securely unsealed for a destination enclave on a third computer. Securely transferring an enclave workload from one computer to another is disclosed.