Enclave Instance Control via Secure Component Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack efficient control over the number of enclave instances running on a platform, leading to potential resource overutilization and licensing issues, as there are no direct mechanisms to limit instances without external intervention.
Innovation Solution
Implementing a secure component as a trusted interface between the trusted platform module and enclaves, where only a base enclave can communicate with it, allowing the platform to determine and enforce a limited number of running instances by receiving indications from other enclaves upon start-up and managing tokens to track instance counts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the licensee starts multiple instances of an enclave from the operating system, then the licensee can gain benefit from additional enclave instances, but the system lacks control over the number of instances leading to potential resource overutilization
Solution Approach 1:
A secure component is introduced as an intermediary between the enclave instances and the operating system. This component maintains a token table that tracks the number of running enclave instances and enforces licensing constraints, thereby providing controlled flexibility without requiring changes to the enclave code or operating system
Solution Approach 2:
The secure component implements a feedback mechanism where enclave instances report their start-up and termination to the token table. The system continuously monitors the number of running instances and provides feedback to enforce the maximum instance limit, ensuring resource utilization remains within licensed parameters
2Device complexity
If hardware based platforms use mechanisms to control the number of program instances, then instance control is achieved, but enclave instances can still be started without limitation except for memory size
Solution Approach 1:
The secure component acts as a mediator that intercepts enclave instance creation requests. It checks the token table to determine if the maximum number of instances has been reached and either permits or blocks the new instance accordingly, thus imposing control without affecting the underlying platform's capability to run enclaves
3Ease of operation
If enclaves are started from the operating system under licensee control, then the licensee can start multiple instances, but there is no direct way to control or limit the enclave state from outside
Solution Approach 1:
The secure component serves as a trusted intermediary that maintains authoritative control over enclave instances through the token table. While enclaves continue to be started from the operating system for ease of operation, the secure component reliably tracks and controls the number of instances, providing external oversight without complicating the startup process
Data Source
Figure 1~8
Figure 2
Figure 3~5
AI summary
There is provided mechanisms for handling instances of enclaves on an execution platform. The execution platform comprises a secure component. The secure component serves as a trusted interface between a trusted platform module of the execution platform and enclaves of an enclave environment on the execution platform. Only a single enclave, denoted base enclave, in the enclave environment is enabled to communicate with the secure component. A method comprises receiving, by the base enclave, an indication from another enclave in the enclave environment upon start-up of a new instance of the so-called another enclave. The method comprises determining, by the base enclave, to enable continued running of the new instance only when number of currently running instances of the so-called another enclave is within an interval of allowed number of running instances of the so-called another enclave.