On the Suitability of Using SGX for Secure Key Storage in the Cloud
This paper addresses the need for secure storage in virtualized services in the cloud. To this purpose, we evaluate the security properties of Intel’s Software Guard Extensions (SGX) technology, which provides hardware protection for general applications, for securing virtual Hardware Security Modul...
Saved in:
Published in | 17th International Conference on Trust, Privacy and Security in Digital Business, TrustBus2020,Bratislava, Slovakia,2020-09-14 - 2020-09-17 Vol. 12395; pp. 32 - 47 |
---|---|
Main Authors | , , , |
Format | Book Chapter Conference Proceeding |
Language | English |
Published |
Cham
Springer International Publishing
2020
|
Series | Lecture Notes in Computer Science |
Subjects | |
Online Access | Get full text |
Cover
Loading…
Summary: | This paper addresses the need for secure storage in virtualized services in the cloud. To this purpose, we evaluate the security properties of Intel’s Software Guard Extensions (SGX) technology, which provides hardware protection for general applications, for securing virtual Hardware Security Modules (vHSM). In order for the analysis to be comparable with analyses of physical HSMs, the evaluation proceeds from the FIPS 140–3 standard, the successor to FIPS 140–2, which is commonly used to assess security properties of HSMs.
Our contribution is twofold. First, we provide a detailed security evaluation of vHSMs using the FIPS 140–3 standard. Second, after concluding that the standard is designed for stand-alone rather than virtual systems, we propose a supplementary threat model, which considers threats from different actors separately. This model allows for different levels of trust in actors with different capabilities and can thus be used to assess which parts of FIPS 140–3 that should be considered for a specific attacker.
Using FIPS 140–3 in combination with the threat model, we find that SGX enclaves provide sufficient protection against a large part of the potential actors in the cloud. Thus, depending on the threat model, SGX can be a helpful tool for providing secure storage for virtualized services. |
---|---|
Bibliography: | This work was partially supported by the Wallenberg AI, Autonomous Systems and Software Program (WASP) and the Swedish Foundation for Strategic Research, grant RIT17-0035. |
ISBN: | 3030589854 9783030589851 |
ISSN: | 0302-9743 1611-3349 |
DOI: | 10.1007/978-3-030-58986-8_3 |