ReplicaTEE: Enabling Seamless Replication of SGX Enclaves in the Cloud
Claudio Soriente, Ghassan Karame, Wenting Li, Sergey Fedorov

TL;DR
ReplicaTEE enables dynamic provisioning and decommissioning of SGX enclaves in the cloud, enhancing elasticity and security for TEE-based applications without significant performance overhead.
Contribution
It introduces a novel SGX-based provisioning layer that securely manages enclave replication and lifecycle without application owner intervention.
Findings
Secure against powerful adversaries with cloud infrastructure compromise
Moderate increase in Trusted Computing Base (~800 LoC)
No significant performance overhead in real cloud environment
Abstract
With the proliferation of Trusted Execution Environments (TEEs) such as Intel SGX, a number of cloud providers will soon introduce TEE capabilities within their offering (e.g., Microsoft Azure). Although the integration of SGX within the cloud considerably strengthens the threat model for cloud applications, the current model to deploy and provision enclaves prevents the cloud operator from adding or removing enclaves dynamically - thus preventing elasticity for TEE-based applications in the cloud. In this paper, we propose ReplicaTEE, a solution that enables seamless provisioning and decommissioning of TEE-based applications in the cloud. ReplicaTEE leverages an SGX-based provisioning layer that interfaces with a Byzantine Fault-Tolerant storage service to securely orchestrate enclave replication in the cloud, without the active intervention of the application owner. Namely, in…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
