Uniform Enclave Interface for Privileged Process Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software applications lack safeguards against processes with higher privileges, such as the host operating system, accessing sensitive data stored within them.
Innovation Solution
The method involves creating an enclave manager in an untrusted environment to generate enclaves, which are protected environments isolating sensitive data. Enclave clients are configured to provide entry points into the enclave, allowing for the creation of trusted application instances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If applications store sensitive data in the host computing device, then data accessibility is improved, but security against privileged processes deteriorates
Solution Approach 1:
The system segments the computing environment into untrusted host environments and trusted enclave environments. Sensitive data is segregated into isolated enclave memory spaces that are inaccessible to privileged host processes, while non-sensitive operations remain in the host environment. This segmentation allows data to be stored in the host device while protecting it from unauthorized access.
Solution Approach 2:
The enclave manager acts as an intermediary between untrusted host processes and trusted enclave code. It provides controlled interfaces for data access, allowing applications to retrieve sensitive data through authenticated enclave calls rather than direct host memory access. This intermediary mechanism maintains security while enabling legitimate data accessibility.
2Reliability
If enclaves are created to protect sensitive data, then security is improved, but system complexity deteriorates
Solution Approach 1:
The enclave manager provides a universal interface that handles multiple security functions through a single component. It manages enclave creation, data access requests, code execution, and thread donation all through one standardized interface. This multi-functionality reduces the number of separate security mechanisms needed, thereby reducing overall system complexity while maintaining strong security.
3Adaptability or versatility
If enclave clients provide multiple entry points, then functionality is improved, but attack surface deteriorates
Solution Approach 1:
Each enclave client entry point is configured with specific, localized access permissions rather than universal access. The initialize function accepts specific system resources, the donate thread function accepts only OS-provided threads, and the destroy function terminates only the specific enclave. This localized quality of access rights reduces the attack surface while maintaining the needed functionality of multiple entry points.
Data Source
AI summary
A uniform enclave interface is provided for creating and operating enclaves across multiple different types of backends and system configurations. For instance, an enclave manager may be created in an untrusted environment of a host computing device. The enclave manager may include instructions for creating one or more enclaves. An enclave may be generated in memory of the host computing device using the enclave manager. One or more enclave clients of the enclave may be generated by the enclave manager such that the enclave clients configured to provide one or more entry points into the enclave. One or more trusted application instances may be created in the enclave.