On the Suitability of Using SGX for Secure Key Storage in the Cloud

Research output: Chapter in Book/Report/Conference proceedingPaper in conference proceedingpeer-review

418 Downloads (Pure)

Abstract

This paper addresses the need for secure storage in virtualized services in the cloud. To this purpose, we evaluate the security properties of Intel's Software Guard Extensions (SGX) technology, which provides hardware protection for general applications, for securing virtual Hardware Security Modules (vHSM). In order for the analysis to be comparable with analyses of physical HSMs, the evaluation proceeds from the FIPS 140--3 standard, the successor to FIPS 140--2, which is commonly used to assess security properties of HSMs.

Our contribution is twofold. First, we provide a detailed security evaluation of vHSMs using the FIPS 140–3 standard. Second, after concluding that the standard is designed for stand-alone rather than virtual systems, we propose a supplementary threat model, which considers threats from different actors separately. This model allows for different levels of trust in actors with different capabilities and can thus be used to assess which parts of FIPS 140--3 that should be considered for a specific attacker.

Using FIPS 140--3 in combination with the threat model, we find that SGX enclaves provide sufficient protection against a large part of the potential actors in the cloud. Thus, depending on the threat model, SGX can be a helpful tool for providing secure storage for virtualized services.
Original languageEnglish
Title of host publicationLecture Notes in Computer Science
PublisherSpringer Science and Business Media B.V.
Pages32-47
Volume12395
ISBN (Print)978-303058985-1
DOIs
Publication statusPublished - 2020
Event17th International Conference on Trust, Privacy and Security in Digital Business, TrustBus2020 - Bratislava, Slovakia
Duration: 2020 Sept 142020 Sept 17

Conference

Conference17th International Conference on Trust, Privacy and Security in Digital Business, TrustBus2020
Country/TerritorySlovakia
CityBratislava
Period2020/09/142020/09/17

Subject classification (UKÄ)

  • Communication Systems
  • Other Computer and Information Science

Free keywords

  • SGX
  • FIPS
  • Trusted Computing
  • Enclaves
  • HSM

Fingerprint

Dive into the research topics of 'On the Suitability of Using SGX for Secure Key Storage in the Cloud'. Together they form a unique fingerprint.

Cite this