Abstract:Security and privacy concerns in computer systems have grown in importance with the ubiquity of connected devices. TEEs provide security guarantees based on cryptographic constructs built in hardware. Intel software guard extensions (SGX), in particular, implements powerful mechanisms that can shield sensitive data even from privileged users with full control of system software. In this work, we essentially explore some of the challenges of designing secure distributed systems by using Intel SGX as cornerstone. We do so by designing and experimentally evaluating several elementary systems ranging from communication and processing middleware to a peer-to-peer privacy-preserving solution. We start with support systems that naturally fit cloud deployment scenarios, namely content-based routing, batching and stream processing frameworks. We implement prototypes and use them to analyse the manifested memory usage issues intrinsic to SGX. Next, we aim at protecting very sensitive data: cryptographic keys. By leveraging TEEs, we design protocols for group data sharing that have lower computational complexity than legacy methods. As a bonus, our proposals allow large savings on metadata volume and processing time of cryptographic operations, all with equivalent security guarantees. Finally, we propose privacy-preserving systems against established services like web-search engines. Our evaluation shows that we propose the most robust system in comparison to existing solutions with regard to user re-identification rates and results accuracy in a scalable way. Overall, this thesis proposes new mechanisms that take advantage of TEEs for distributed system architectures. We show through an empirical approach on top of Intel SGX what are the trade-offs of distinct designs applied to distributed communication and processing, cryptographic protocols and private web search.

Tailoring and Verification of the Trust Boundaries in a Heterogeneous TEE Landscape

HasTEE+ : Confidential Cloud Computing and Analytics with Haskell

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

On Making Emerging Trusted Execution Environments Accessible to Developers

The Road to Trust: Building Enclaves within Confidential VMs

Distributed systems and trusted execution environments: Trade-offs and challenges

End-to-End Security for Distributed Event-Driven Enclave Applications on Heterogeneous TEEs

Formal Verification of Virtualization-Based Trusted Execution Environments

TRUST: A Toolkit for TEE-Assisted Secure Outsourced Computation over Integers

Composite Enclaves: Towards Disaggregated Trusted Execution

Performance Analysis of Scientific Computing Workloads on Trusted Execution Environments

Runtime Verification for Trustworthy Computing

A Confidential Computing Transparency Framework for a Comprehensive Trust Chain

Understanding TEE Containers, Easy to Use? Hard to Trust

Scanclave: Verifying Application Runtime Integrity in Untrusted Environments

Query Authentication Using Intel SGX for Blockchain Light Clients

Research Directions for Verifiable Crypto-Physically Secure TEEs

Empowering Data Centers for Next Generation Trusted Computing

Remote Credential Management with Mutual Attestation for Trusted Execution Environments

TALUS: Reinforcing TEE Confidentiality with Cryptographic Coprocessors (Technical Report)