Abstract:Security and privacy concerns in computer systems have grown in importance with the ubiquity of connected devices. TEEs provide security guarantees based on cryptographic constructs built in hardware. Intel software guard extensions (SGX), in particular, implements powerful mechanisms that can shield sensitive data even from privileged users with full control of system software. In this work, we essentially explore some of the challenges of designing secure distributed systems by using Intel SGX as cornerstone. We do so by designing and experimentally evaluating several elementary systems ranging from communication and processing middleware to a peer-to-peer privacy-preserving solution. We start with support systems that naturally fit cloud deployment scenarios, namely content-based routing, batching and stream processing frameworks. We implement prototypes and use them to analyse the manifested memory usage issues intrinsic to SGX. Next, we aim at protecting very sensitive data: cryptographic keys. By leveraging TEEs, we design protocols for group data sharing that have lower computational complexity than legacy methods. As a bonus, our proposals allow large savings on metadata volume and processing time of cryptographic operations, all with equivalent security guarantees. Finally, we propose privacy-preserving systems against established services like web-search engines. Our evaluation shows that we propose the most robust system in comparison to existing solutions with regard to user re-identification rates and results accuracy in a scalable way. Overall, this thesis proposes new mechanisms that take advantage of TEEs for distributed system architectures. We show through an empirical approach on top of Intel SGX what are the trade-offs of distinct designs applied to distributed communication and processing, cryptographic protocols and private web search.

Benchmarking Analytical Query Processing in Intel SGXv2

A Comprehensive Benchmark Suite for Intel SGX

A Survey of Intel SGX and Its Applications.

On the Performance of Intel SGX

DuckDB-SGX2: The Good, The Bad and The Ugly within Confidential Analytical Query Processing

An Experimental Evaluation of TEE technology Evolution: Benchmarking Transparent Approaches based on SGX, SEV, and TDX

Performance Analysis of Scientific Computing Workloads on Trusted Execution Environments

Performance Principles for Trusted Computing with Intel SGX

Exploring Dynamic Task Loading in SGX-Based Distributed Computing

Characterizing AI Model Inference Applications Running in the SGX Environment

Query Authentication Using Intel SGX for Blockchain Light Clients

QShield: Protecting Outsourced Cloud Data Queries with Multi-User Access Control Based on SGX

Enjoy the Untrusted Cloud: A Secure, Scalable and Efficient SQL-like Query Framework for Outsourcing Data

Efficiently Hardening SGX Enclaves against Memory Access Pattern Attacks via Dynamic Program Partitioning

Empowering Data Centers for Next Generation Trusted Computing

Distributed systems and trusted execution environments: Trade-offs and challenges

The Road to Trust: Building Enclaves within Confidential VMs

Sharing without Showing: Secure Cloud Analytics with Trusted Execution Environments

Designing a Provenance Analysis for SGX Enclaves

Rphx: Result Pattern Hiding Conjunctive Query Over Private Compressed Index Using Intel SGX