Skip to content

Glossary

  • attestation

    Process of proving the integrity and authenticity of the attestee's software or hardware component to a verifier. This includes validating if a given software is executed on a given hardware.

    • local attestation

      Attestation executed locally, e.g., one software component validates the integrity and authenticity of another software component which is executed on the same hardware. In Intel SGX, the CPU creates a report containing integrity information of the attested enclave whose keyed-MAC can only be verified, and changed for that matter, by the verifier enclave running on the same platform.

    • remote attestation

      Attestation executed remotely, i.e., the component which does the validation and the component which is validated are executed on different machines. In Intel SGX, the report received during local attestation is signed with the quoting enclave's private key making the integrity of the quote - the signed report - remotely verifiable.

    • Configuration and Attestation Service (CAS)

      The Configuration and Attestation Service (CAS) is a component of the SCONE infrastructure. Programs executed in enclaves, in particular, SCONE-enabled executables, connect to CAS to obtain their confidential configuration. CAS provisions this configuration only after it has verified the integrity and authenticity of the requesting enclave. Additionally CAS checks that the requesting enclave is allowed to obtain the confidential configuration. Initially, configurations are pushed to the CAS with the SCONE client.

    • Local Attestation Service (LAS)

      A per-platform-service enabling remote attestation of SGX enclaves independently of the framework (i.e., SCONE or Intel SDK) used to create the enclave. It separates the development of SCONE-enabled applications from the Intel SDK by providing a stable interface to the attestation facilities of Intel's SDK and decouples the availability of applications deployed on the SCONE platform from Intel's Attestation Service, in conjunction with the CAS, through the introduction of an independent quoting enclave.

  • booting

    • secure boot

      A boot procedure which allows only the execution of firmware, bootloaders and operating systems which are digitally signed by a (well) defined set of acceptable signers.

    • measured boot

      A boot procedure which measures the state of the system at each boot step. This measurement can be accessed to verify the current state of a given system. Compared to secure boot, measured boot will not prevent an "insecure" state of the system.

  • cloud-native application

    An application designed to run inside of a cloud. One requirement is that the application is deployed with the help of containers.

  • cloud provider

    An entity providing cloud services (PaaS, IaaS, MaaS etc.) to its customers. It is assumed that a cloud provider is in physical or logical control of the hardware and system software used to provide the cloud services.

  • container

    An light-weight alternative to a virtual machine (VM). The isolation of containers is implemented by the operating system. Docker and Kubernetes use Linux for isolation. In the case of VMs, the isolation is implemented with the help of CPU extensions.

  • curated image

    A container image of a popular service maintained by scontain.com.

  • enclave.

    This is an alias for SGX enclave.

  • Docker image

    A snapshot of a container's state that can be used to initialize new containers with the same state.

  • Docker registry

    A Docker registry stores Docker images for the purpose of easy distribution comparable to the app stores of Android or iOS.

  • EPC.

    A cache of memory pages belonging to enclaves. This cache resides in a reserved part of the main memory that is directly managed by the CPU (and not by the operating system or the hypervisor). The data in this cache is encrypted. Unlike enclave pages residing in the main memory, the CPU can encrypt and decrypt individual cache lines residing inside the EPC. This results in low overheads.

  • microservice

    A rather small component which offers a single service.

  • service provider

    A company operating an application - typically, making these available via the Internet. We use this a general term that includes different models like Software as a Service (SaaS) providers as well as Hosted service providers etc.

  • SCONE

    A software framework, jointly developed by the SERECA and SecureCloud EU projects, allowing the trustworthy execution of unmodified x86 source code within Intel SGX enclaves. It consists of components enabling the execution inside enclaves such as the SCONE runtime and the C, C++, Fortran, Go, and Rust SCONE cross-compilers, components ensuring the trustworthiness of this execution and deployment in clouds such as the CAS and SCONE client.

    • SCONE Docker image

      A SCONE Docker image is a Docker image that contains an SCONE-enabled executable and is additionally annotated via image labels with metadata allowing the attestation of the started SCONE-enabled executable and the image's file system content.

    • SCONE container

      A SCONE container is a running instance of a SCONE Docker image.

    • SCONE microservice

      Microservice which is a SCONE-enabled executable.

    • SCONE-enabled executable

      An executable created by a SCONE cross-compiler. The actual program will be executed within an enclave and utilises the SCONE runtime.

    • SCONE runtime

      The runtime environment necessary to execute a SCONE-enabled executable. At the moment this consists of a modified C-library based on the musl library.

    • SCONE cross-compiler

      Compilers for various programming languages such as C, C++, Rust, Go, and Fortran which compile source code into a SCONE-enabled executable.

    • SCONE client

      A program that is used to configure SCONE-enabled executables. It allows the user to push confidential configurations to the CAS and encrypt files to ensure their content is only accessible by specific SCONE-enabled executables executed inside enclaves.

    • SCONE infrastructure

      The SCONE infrastructure summarises all components necessary to deploy and run a SCONE-enabled executable. This includes Docker components like the Docker daemon and the Docker registry as well as the SCONE client and additional services like CAS and LAS.

  • Secure container.

    A container which uses additional hardware isolation mechanisms, i.e., SGX to provide better application security. In particular, a secure container runs one or more secure programs. Additionally, the integrity and confidentiality of files inside a secure container are protected by SCONE.

  • Secure program.

    A program that executes inside an enclave.

  • SGX (Software Guard eXtension).

    A CPU extension by Intel that permits to create SGX enclaves.

  • SGX enclave.

    A protected area inside the address space of a program such that only the code inside this enclave can access the data and code stored in this address range. All pages belonging to an enclave are encrypted by the CPU and only the CPU knows the encryption key. These pages can reside in the main memory or the EPC.

  • threading. SCONE uses different kind of threads:

    • ethread: a thread that executes application threads inside of an enclave
    • lthread: an application thread. Typically, created by the application directly or indirectly via a pthread_create call. In SCONE, this pthread_create call will create a lthread. The lthread is executed by some ethread. In this way, we can quickly switch to another application thread whenever an application thread would get block. In this way, we reduce the number of enclave entries and exits - which are costly.
    • sthread: a thread that runs outside of the enclave and that executes system calls on behalf of the threads running inside the enclave
  • trusted computing base (TCB)

    The set of hardware and software components which can break the security policy. Therefore one has to trust that these components are not malicious or faulty.

  • trusted execution environment (TEE)

    A piece of hardware which allows secure processing. Usually the achieved protection goals are confidentiality and integrity.

© scontain.com and SecureCloud, March 2018. Questions or Suggestions?