Abstract:Security and privacy concerns in computer systems have grown in importance with the ubiquity of connected devices. TEEs provide security guarantees based on cryptographic constructs built in hardware. Intel software guard extensions (SGX), in particular, implements powerful mechanisms that can shield sensitive data even from privileged users with full control of system software. In this work, we essentially explore some of the challenges of designing secure distributed systems by using Intel SGX as cornerstone. We do so by designing and experimentally evaluating several elementary systems ranging from communication and processing middleware to a peer-to-peer privacy-preserving solution. We start with support systems that naturally fit cloud deployment scenarios, namely content-based routing, batching and stream processing frameworks. We implement prototypes and use them to analyse the manifested memory usage issues intrinsic to SGX. Next, we aim at protecting very sensitive data: cryptographic keys. By leveraging TEEs, we design protocols for group data sharing that have lower computational complexity than legacy methods. As a bonus, our proposals allow large savings on metadata volume and processing time of cryptographic operations, all with equivalent security guarantees. Finally, we propose privacy-preserving systems against established services like web-search engines. Our evaluation shows that we propose the most robust system in comparison to existing solutions with regard to user re-identification rates and results accuracy in a scalable way. Overall, this thesis proposes new mechanisms that take advantage of TEEs for distributed system architectures. We show through an empirical approach on top of Intel SGX what are the trade-offs of distinct designs applied to distributed communication and processing, cryptographic protocols and private web search.

On Securing Cloud-Hosted Cyber-Physical Systems Using Trusted Execution Environments

Position Paper: On Using Trusted Execution Environment to Secure COTS Devices for Accessing Industrial Control Systems

A Trustenclave-Based Architecture for Ensuring Run-Time Security in Embedded Terminals

Distributed systems and trusted execution environments: Trade-offs and challenges

End-to-End Security for Distributed Event-Driven Enclave Applications on Heterogeneous TEEs

TeTPCM: Building Endogenous Trusted Computing on Trusted Execution Environment

Template for Preparation of Manuscripts for Tsinghua Science and Technology

Distributed Shielded Execution for Transmissible Cyber Threats Analysis

Fine-grained access control based on Trusted Execution Environment

ISA-Based Trusted Network Functions And Server Applications In The Untrusted Cloud

TEEI - A Mobile Security Infrastructure for TEE Integration

Quantum Operating System Support for Quantum Trusted Execution Environments

You Can't Always Check What You Wanted: Selective Checking and Trusted Execution to Prevent False Actuations in Cyber-Physical Systems

CTR: Checkpoint, Transfer, and Restore for Secure Enclaves

Enhancing IoT Security and Privacy with Trusted Execution Environments and Machine Learning

Securing Cloud File Systems with Trusted Execution

Formal Verification of Virtualization-Based Trusted Execution Environments

CCxTrust: Confidential Computing Platform Based on TEE and TPM Collaborative Trust

HasTEE+ : Confidential Cloud Computing and Analytics with Haskell

Towards Trust Proof for Secure Confidential Virtual Machines

On Practicality of Using ARM TrustZone Trusted Execution Environment for Securing Programmable Logic Controllers