Secure Runtime System Using Hardware Enclaves
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based computing environments face security issues as data is not encrypted during runtime processing, exposing it to unauthorized users or systems when decrypted for application use.
Innovation Solution
Implementing a secure runtime system that creates a trusted execution environment (TEE) using secure enclaves, which encrypts data at all times and provides a secure channel for communication, preventing unauthorized access and tampering by isolating applications and their data within hardware-supported secure enclaves.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is decrypted for runtime processing, then applications can process and use the data, but data security is compromised and exposed to unauthorized users or systems
Solution Approach 1:
The system segments the computing environment into trusted and untrusted zones by creating secure enclaves (isolated memory regions) where data can be decrypted and processed safely. The enclave architecture divides the runtime environment so that sensitive operations occur in isolated, protected spaces, allowing data usability within the enclave while maintaining security boundaries against the untrusted host system.
Solution Approach 2:
The patent introduces secure enclaves as intermediary isolated environments between the untrusted host system and the data processing operations. These enclaves act as mediators that allow applications to access and process decrypted data while preventing unauthorized access from the host OS or hypervisor, thus enabling data usability without compromising security.
2Reliability
If data is encrypted during runtime processing, then data security is maintained, but processing speed and application performance are reduced
Solution Approach 1:
The system performs preliminary encryption of data before it is loaded into the secure enclave for processing. By encrypting data in advance and only decrypting it within the protected enclave environment, the system maintains security without requiring continuous encryption/decryption operations during processing, thereby minimizing performance overhead while preserving data security.
3Adaptability or versatility
If cloud-based computing is used, then computing resources are accessible and scalability is improved, but security control is reduced compared to local devices
Solution Approach 1:
The patent introduces secure enclaves as intermediary isolated environments between the untrusted host system and the data processing operations. These enclaves act as mediators that allow applications to access and process decrypted data while preventing unauthorized access from the host OS or hypervisor, thus enabling data usability without compromising security.
Solution Approach 2:
The system applies local quality by creating isolated secure enclave environments with specialized security properties within the cloud infrastructure. Each enclave provides localized security controls and protection mechanisms that are tailored to the specific data processing needs, allowing cloud accessibility while maintaining localized security boundaries that prevent unauthorized access.
Data Source
AI summary
Example secure runtime systems and methods are described. In one implementation, a secure runtime system is configured to execute multiple applications in a secure manner. The secure runtime is associated with a secure enclave defined by a hardware device. A secure application loader is configured to load an application into the secure runtime system and an OS bridge is configured to provide OS services to the application.