Skip to content

Technical summary of SCONE

SCONE Technical Summary

SCONE is a platform to build and run secure applications with the help of Intel SGX (Software Guard eXtensions)1. In a nutshell, our objective is to run applications such that data is always encrypted, i.e., all data at rest, all data on the wire as well as all data in main memory are encrypted. Even the program code can be encrypted. SCONE helps to protect data, computations and code against attackers with root access.

SCONE Unmodified Application

We aim to make it as easy as possible to secure existing applications. Switching to SCONE is simple since applications do not need to be modified. SCONE supports the most popular programming languages like JavaScript, Python - including PyPy, Java, Rust, Go, C, and C++ but also some ancient languages like Fortran. Avoiding source code changes helps to ensure that applications can later run on different trusted execution environments. Moreover, there is no risk for hardware lock-in or software lock-in - even into SCONE.

SCONE can be used on top of Kubernetes and Docker.

So, what problems can SCONE help to solve?

Secure application configuration

SCONE provides applications with secrets in a secure fashion. Why is that a problem? Say, you want to run MySQL and you configure MySQL to encrypt its data at rest. To do so, MySQL requires a key to decrypt and encrypt its files. One can store this key in the MySQL configuration file but this configuration file cannot be encrypted since MySQL would need a key to decrypt the file. SCONE helps developers to solve such configuration issues in the following ways:

  • secure configuration files. SCONE can transparently decrypt encrypted configuration files, i.e., without the need to modify the application. It will give access to the plain text only to a given program, like, MySQL. No source code changes are needed for this to work.

  • secure environment variables. SCONE gives applications access to environment variables that are not visible to anybody else - even users with root access or the operating system. Why would I need this? Consider the MySQL example from above. You can pass user passwords via environment variables like MYSQL_ROOT_PASSWORD and MYSQL_PASSWORD to MySQL. We need to protect these environment variables to prevent unauthorized accesses to the MySQL database.

  • secure command line arguments. Some applications might not use environment variables but command line arguments to pass secrets to the application. SCONE provides a secure way to pass arguments to your application without other privileged parties, like the operating system, being able to see the arguments.

SCONE Secure Application Configuration

Transparent attestation

SCONE verifies that the correct code is running before passing any configuration info to the application. To ensure this, SCONE provides a local attestation and configuration service: this service provides only the code with the correct signature (MrEnclave) with its secrets: certificates, arguments, environment variables and keys. It also provides the application with a certificate that shows that the application runs inside an enclave. Note that this can be done completely transparently to the application, i.e., no application source code changes are required: the encrypted certificate can be stored in the file system where the application expects its certificates.

For debugging and development, you can run code inside enclaves without attestation.

SCONE Application Attestation

Two applications can ensure that they run inside enclaves via TLS authentication. In this way we can ensure that the client certificate and the server certificate were issued by the SCONE CAS, i.e., both communication partners run inside of enclaves and have the expected MrEnclave.

SCONE TLS Attestation

Secure main memory

An adversary with root access can read the memory content of any process. In this way, an adversary can gain access to keys that an application is using, for example, the keys to protect its data at rest. SCONE helps to protect the main memory:

  • no access by adversaries - even those who have root access,

  • no access by the operating system - even if compromised,

  • no access by the hypervisor - even if compromised, and

  • no access by the cloud provider, and

  • no access by evil maids - despite having physical access to the host.

Integration with secure key store

Encryption keys must be protected. In many installations, one does not want humans to be able to see encryption keys. Hence, one can generate keys and stores in SCONE CAS. SCONE also supports the integration with a keystore like Vault. SCONE can run Vault inside of an enclave to protect Vaults secrets in the main memory.

SCONE Transparent TLS Shield

Transparent TLS encryption

Some popular applications like memcached or Zookeeper2 do not support TLS out of the box. SCONE can transparently add TLS encryption to TCP connections: the connections are terminated inside of the enclave. In this way, the plain text is never seen by the operating system or any adversary. Note that one should not use an external process for TLS termination3.

SCONE Transparent TLS Shield

Transparent file protection

SCONE protects the integrity and confidentiality of files via transparent file protection. This protection does not require any source code changes. A file can either be integrity-protected only (i.e., the file is stored in plain text but modifications are detected) or confidentiality- and integrity-protected (i.e., the file is encrypted and modifications are detected).

SCONE Transparent File Encryption

Ease of use

We provide an easy-to-use CLI supporting always encrypted execution as well as simplify the construction of remote applications that support always encryption.

  1. We plan to support alternative trusted execution environments in future releases of SCONE. ↩

  2. Zookeeper replicates its state amongst a group of servers. Zookeeper does not support protecting the communication between these servers by TLS. SCONE can add transparent support TLS for Zookeeper to ensure that the integrity and confidentiality of the data exchanged between the Zookeeper server are protected. ↩

  3. Memcached could be protected, for example, with the help of a stunnel. The communication between memcached and stunnel is not encrypted and hence, adversaries with root access would see the unencrypted traffic. ↩