Erlang SGX - Protecting Confidential Erlang Workloads with Intel SGX

Examensarbete för masterexamen

Please use this identifier to cite or link to this item:
Download file(s):
File Description SizeFormat 
CSE 20-57 Hemdal Roxbergh.pdf1.48 MBAdobe PDFThumbnail
Bibliographical item details
Type: Examensarbete för masterexamen
Title: Erlang SGX - Protecting Confidential Erlang Workloads with Intel SGX
Authors: Hemdal, Emil
Roxbergh, Eliot
Abstract: Secure enclaves, such as Intel sgx, provide a trusted execution environment which offers integrity and confidentiality guarantees to supported applications. In this thesis, we show how Erlang can be protected to harden telecommunication workloads by utilizing hardware-based Intel sgx. First, we demonstrate how an untrusted Erlang runtime can execute trusted c code inside of sgx via Erlang C Nodes and nifs. A possible use case is the protection of cryptographic functionality which is demonstrated with OpenSSL inside of sgx, callable from Erlang. Second, to protect the Erlang runtime itself, a number of alternatives are explored as to enable execution of Erlang code inside of the enclave. However, Erlang ships with beam, an advanced virtual machine, which performs frequent syscalls and io activity that drastically increases the complexity of porting it to sgx enclaves. Therefore, two prominent third-party frameworks are tested which aim to support generic applications inside of sgx: the Library os Graphene and the shim-layer solution scone. Third, alternatives to implement a custom solution are discussed which could yield performance and security benefits over the generic frameworks while protecting an Erlang runtime. The complete source code for this thesis is available under a permissive bsd 3 license.
Keywords: Erlang;beam;Intel-sgx;Graphene;scone;secure-enclave;trusted-computing
Issue Date: 2020
Publisher: Chalmers tekniska högskola / Institutionen för data och informationsteknik
Collection:Examensarbeten för masterexamen // Master Theses

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.