Enabling the Use of Strongly-Private Algorithms Kubilay Ahmet Kk - PowerPoint PPT Presentation

DEPARTMENT OF COMPUTER SCIENCE SOFTWARE AND SYSTEMS SECURITY RESEARCH GROUP Enabling the Use of Strongly-Private Algorithms Kubilay Ahmet Küçük (PhD candidate, 4 th year) kucuk@cs.ox.ac.uk Supervisor: Prof. Andrew MARTIN Content from Journal Article, accepted on 03th May 2019. To be appear online in Jul/Aug 2019. KA Kucuk, David Grawrock, Andrew Martin. Managing confidentiality leaks through private algorithms on Software Guard eXtensions (SGX) enclaves: Minimised TCB on secret-code execution with Early-Private Mode (EPM). SpringerOpen EURASIP Journal on Information Security (Special Issue on Recent Advances in Software Security).

Enclave binary is inspectable by its’ nature Hardware Owner's Algorithm Owner's Sending Enclave Binary Fill Key: Asset Type Environment Environment Source Code U n t Compiled Binary r u Untrusted Application Part s Encrypted Memory Encrypted t e Enclave Memory d 4KB Page Trusted Granularity Interface Controlled by T Auto Operating r Generated System u s ECALL t OCALL e Functions d Binary Loaded Compiled binary disassembled Programming the Enclave functions to Enclave Memory objdump -d enclave.signed.so Containing Application Logic Time before Enclave loaded into memory After Loading Binary 2 Questions or Contact :kucuk@cs.ox.ac.uk

Enclave-Aware or Enclave-Independent development Algorithm Owner (AO) Approach 1: AO and ED on the same side Approach 2: HO and ED together Has Secret Algorithm Protect the Secret-Code Before Release Protect the Secret-Code After Release or Business Logic HO AO HO Hardware Owner (HO) has Cloud Infrastructure for Remote Execution ED AO Enclave Developer (ED) ED Responsible for Secure Implementation Sending an Enclave- aware Algorithm Sending an Enclave- independent Algorithm Ensuring the code secrecy before its release Maintaining the code secrecy after its release 3 Questions or Contact :kucuk@cs.ox.ac.uk

Enclave-Independent Private Algorithms 4 Questions or Contact :kucuk@cs.ox.ac.uk

Enclave-Aware Private Algorithms 5 Questions or Contact :kucuk@cs.ox.ac.uk

New Possibilities with 3 Stake Holders § Computational Power as a Service (CPaaS) § Algorithm Querying as a Service (AQaaS) § Data Querying as a Service (DQaaS) 6 Questions or Contact :kucuk@cs.ox.ac.uk

New Problems / Future Work § Integrate Key sharing and separation ( KSS ) § Modular Attestation § Secure Erase § Ownership Transfer § … Contact: kucuk@cs.ox.ac.uk Read more à 7 Questions or Contact :kucuk@cs.ox.ac.uk