Nested Enclave Identity Abstraction for Multi-Platform Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure computing systems face challenges in simplifying the development of enclave clients and software that run inside enclaves, as they require customization for specific hardware features and lack a unified approach to support multiple native enclave platforms like Intel's SGX and Microsoft's VSM.
Innovation Solution
An abstraction model for enclaves is introduced, which includes an abstraction layer that translates communication between enclave clients and native platforms, enabling a single version of enclave software to run on multiple architectures and providing primitives for lifecycle management, attestation, data sealing, and security features like monotonic counters and trusted time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enclave software is customized for specific hardware features, then security and reliability are improved, but device complexity and difficulty of deployment increase
Solution Approach 1:
The patent implements a universal enclave interface layer that can work with multiple different enclave platforms (Intel SGX, Microsoft VSM, and other hardware-based enclave systems). This interface layer provides a standardized API that abstracts away platform-specific details, allowing the same enclave software to run reliably across different hardware implementations without requiring customization for each platform while maintaining security guarantees.
Solution Approach 2:
The patent introduces an intermediary enclave runtime environment that sits between the enclave software and the underlying hardware platform. This runtime provides translation and adaptation layers that handle platform-specific security features while presenting a unified interface to developers. The intermediary manages the complexity of different hardware features internally while maintaining simple, consistent security semantics for the enclave code.
2Adaptability or versatility
If a unified enclave interface is implemented, then ease of operation and adaptability improve, but device complexity increases
Solution Approach 1:
The patent segments the enclave system into distinct layers: a hardware-specific lower layer that handles platform details, a middle runtime layer that provides cross-platform compatibility, and an upper software layer that implements enclave logic. This segmentation allows each layer to handle its specific complexity independently, with clear interfaces between layers. The abstraction complexity is confined to the runtime layer, while the enclave software itself remains simple and platform-agnostic.
3Productivity
If hardware-specific optimizations are used, then productivity and performance improve, but adaptability worsens
Solution Approach 1:
The patent implements a parameter-based configuration system where enclave behavior can be adjusted through parameters and flags rather than code changes. The unified interface accepts standardized parameters that map to different hardware features, allowing the same enclave code to be optimized for different platforms by changing runtime parameters. This enables hardware-specific optimizations to be applied automatically based on the target platform without requiring code modifications, thus maintaining both productivity and adaptability.
Data Source
AI summary
A nested enclave identity is presented. A nested identity is indicative of one or more possible enclave instantiations according to one or more identity types. Enclave identities may be nested such that a lower level identity type corresponds to a subset of the possible enclave instantiations that a higher level identity type corresponds to. Techniques disclosed include instantiating an enclave with a nested identity at a software interface to an enclave platform, and performing an operation related to the instantiated enclave using the nested identity.