🖥️

What is Intel SGX

2020/11/19に公開

Summary

TEE is trusted enclaved environment. SGX is one of the implementations of TEE. SGX enables execution of code in protected and private environment. Encrypted programs are executed inside SGX so even if the owner of SGX can't see the data. SGX returns the result which is called report and hash of the program with their unique signature.

Client verify signature through Attestation Service (REST API service provided by Intel).

Process

Client send encrypted request
Server send their programs and encrypted data(without decrypting) to SGX
SGX decrypt encrypted data and execute code and return data
- Data returned by SGX includes hash of the program, result value and signature
- SGX cannot be accessed by server because protected by Hardware.
Server return data to client
Client verify signature through API provided by Intel.
Client verify hash by comparing hash of source code.
- Client should be accessible to the source code and binary.