Abstract:Security and privacy concerns in computer systems have grown in importance with the ubiquity of connected devices. TEEs provide security guarantees based on cryptographic constructs built in hardware. Intel software guard extensions (SGX), in particular, implements powerful mechanisms that can shield sensitive data even from privileged users with full control of system software. In this work, we essentially explore some of the challenges of designing secure distributed systems by using Intel SGX as cornerstone. We do so by designing and experimentally evaluating several elementary systems ranging from communication and processing middleware to a peer-to-peer privacy-preserving solution. We start with support systems that naturally fit cloud deployment scenarios, namely content-based routing, batching and stream processing frameworks. We implement prototypes and use them to analyse the manifested memory usage issues intrinsic to SGX. Next, we aim at protecting very sensitive data: cryptographic keys. By leveraging TEEs, we design protocols for group data sharing that have lower computational complexity than legacy methods. As a bonus, our proposals allow large savings on metadata volume and processing time of cryptographic operations, all with equivalent security guarantees. Finally, we propose privacy-preserving systems against established services like web-search engines. Our evaluation shows that we propose the most robust system in comparison to existing solutions with regard to user re-identification rates and results accuracy in a scalable way. Overall, this thesis proposes new mechanisms that take advantage of TEEs for distributed system architectures. We show through an empirical approach on top of Intel SGX what are the trade-offs of distinct designs applied to distributed communication and processing, cryptographic protocols and private web search.

Pldb: Protecting LSM-based Key-Value Store Using Trusted Execution Environment

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

A Last-Level Defense for Application Integrity and Confidentiality

LSKV: A Confidential Distributed Datastore to Protect Critical Data in the Cloud

Query Authentication Using Intel SGX for Blockchain Light Clients

Protecting In-memory Data Cache with Secure Enclaves in Untrusted Cloud.

Keys in the Clouds: Auditable Multi-device Access to Cryptographic Credentials

Distributed systems and trusted execution environments: Trade-offs and challenges

Aria: Tolerating Skewed Workloads in Secure In-memory Key-value Stores

An Efficient Design and Implementation of LSM-tree Based Key-Value Store on Open-Channel SSD.

SA-LSM

Trust Beyond Border: Lightweight, Verifiable User Isolation for Protecting In-Enclave Services.

SpacKV: A Pmem-Aware Key-Value Separation Store Based on LSM-Tree

A First Look At Efficient And Secure On-Device LLM Inference Against KV Leakage

SGX-LKL: Securing the Host OS Interface for Trusted Execution

MPTEE: Bringing Flexible and Efficient Memory Protection to Intel SGX

Lessons Learned from Blockchain Applications of Trusted Execution Environments and Implications for Future Research

Enabling Strong Database Integrity using Trusted Execution Environments

Differentiated Key-Value Storage Management for Balanced I/O Performance

Accelerating LSM-Tree with the Dentry Management of File System

VeDB: A Software and Hardware Enabled Trusted Relational Database.