I Can’t Escape Myself: Cloud Inter-Processor Attestation and Sealing using Intel SGX

SGX enclaves protect the code and data within from untrusted software, but do not retain their state when destroyed. Sealing allows preserving this data for future use by storing it outside the enclave boundary: the data is encrypted with a fresh secret key, and this key is bound to the processor that sealed the data and, either to the enclave measurement, or the public key of the enclave author. However, in a cloud environment, customers do not choose in which processor their code executes: the enclave that seals some data (for backup or future use) may be destroyed and later instantiated on a different processor or migrated to another processor. In those cases, the new processor would not be able to unseal the data, since the secret key is bound to the sealing processor.This paper presents Inter-Processor Attestation and Sealing (IPAS), a novel sealing mechanism for cloud environments and Intel SGX. In IPAS, sealed data is no longer bound to the sealing processor, but only to the enclave measurement or the public key of the enclave author, thus enabling other processors to unseal the sealed data. This is achieved without exporting the sealing secret key outside the enclave and without trusting third parties.