Secure In-Memory Database in Container via Enclave
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container isolation mechanisms fail to adequately protect in-memory databases from unauthorized access, including attacks by higher-privileged software and physical attackers, due to weaker isolation guarantees and performance overheads associated with enclave systems.
Innovation Solution
Implementing a hardware mechanism using enclaves, such as Intel's Software Guard Extensions (SGX), where application code and sensitive data are stored within a trusted execution environment, while the in-memory database is stored outside the enclave, with a paging mechanism to support larger memory footprints and minimize performance overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If container isolation mechanisms are used to protect in-memory databases, then resource efficiency and ease of operation are improved, but security against unauthorized access and higher-privileged software is worsened
Solution Approach 1:
The patent implements a nested security architecture where an enclave (trusted execution environment) is embedded within a container. The enclave provides hardware-based security boundaries inside the software-based container, creating multiple layers of protection. This allows the system to maintain the operational simplicity of containers while adding enclave-level security for sensitive database operations and data protection.
2Reliability
If enclave systems are used to protect in-memory databases, then security against unauthorized access is improved, but performance overhead and device complexity are worsened
Solution Approach 1:
The patent applies enclave technology selectively rather than universally. Only specific sensitive operations and data access paths are routed through the enclave, while non-sensitive database operations continue to execute outside the enclave in the traditional container environment. This localized application of security reduces the performance overhead associated with enclave operations while maintaining protection for critical functions.
3Reliability
If enclave systems are used to protect in-memory databases, then security against physical attackers is improved, but device complexity is worsened
Solution Approach 1:
The patent introduces a shim layer as an intermediary between the application and the enclave system. This shim handles the complexity of enclave management, memory mapping, and security context switching, shielding the application developer from enclave-related complexity. The shim translates high-level database operations into enclave-specific operations, managing the device complexity internally while presenting a simplified interface to users.
Data Source
AI summary
In an example embodiment, a hardware mechanism for protecting user-level software from privileged system software is leveraged to protect in-memory databases in container implementations in a cloud. This hardware mechanism takes the form of an enclave. An enclave is a portion of a CPU that shields application code and data from accesses by other software, including higher-privileged software. Memory pages belonging to an enclave reside in the enclave page cache (EPC), which cannot be accessed by code outside of the enclave. This helps ensure that (1) applications built on top of in-memory database are securely trusted, (2) and a trusted path architecture is provided for enclaves allowing in-memory databases to run securely on top of untrusted cloud platform.