セキュアエンクレーブを実装する方法

问题

通常のメモリ上で実行すると、機密性の高いコードやデータはホスト OS、ハイパーバイザー、物理攻撃に晒されます。ホストが侵害された場合でもシークレットを守るため、ハードウェアで隔離された実行環境であるセキュアエンクレーブが必要です。

前提条件

• CPU アーキテクチャとメモリ管理の理解
• 信頼実行環境（TEE）への習熟
• リモート認証とコード署名に関する知識

ステップ

1. 1. Select the TEE platform and enclave SDK

   Choose based on hardware: Intel SGX (SGX SDK, Open Enclave), AMD SEV-SNP (memory encryption for VMs), ARM TrustZone / CCA (OP-TEE, TrustZone OP-TEE), or NVIDIA Confidential Computing. SGX creates enclaves at process level with encrypted memory pages. SEV encrypts entire VMs. TrustZone provides a secure world partition. Install the platform SDK and configure the build toolchain. Use the file hash tool to verify SDK integrity.

   入力

   platform: Intel SGX | SDK: Open Enclave

   输出

   toolchain configured | enclave memory encryption enabled

2. 2. Design the enclave boundary and interface

   Minimize the code inside the enclave (trusted computing base). Put only security-critical operations in the enclave: key management, cryptographic operations, sensitive data processing. Define the ECALLs (enclave entry points) and OCALLs (enclave exit points) interface. Data crosses the boundary explicitly — validate all inputs at the boundary. The enclave cannot make system calls directly; it requests them via OCALLs. Use the config validator to define the enclave manifest.

   入力

   operations: keyGen, decrypt, sign

   输出

   ECALLs: {keyGen, decrypt, sign} | OCALLs: {writeFile, log}

3. 3. Implement remote attestation

   Remote attestation proves to a remote party that the code running in the enclave is the expected code on genuine hardware. The enclave generates a quote containing its measurement (MRENCLAVE hash of code and data), signed by the platform's attestation key. The remote party verifies: (1) the quote signature, (2) the measurement matches the expected enclave binary, (3) the platform is genuine (via attestation service). Only after attestation does the remote party send secrets to the enclave. Use the hash and SHA tools for measurements.

   入力

   enclave binary: enclave.signed.so

   输出

   MRENCLAVE: a1b2c3... | quote verified | attestation: PASS

4. 4. Handle sealing and secure data flow

   Sealing encrypts enclave data with a key derived from the enclave measurement and platform, allowing data to persist across enclave restarts while remaining inaccessible to other enclaves or the host. Use sealing for persistent secrets (database encryption keys). For data flow: encrypt data before it leaves the enclave (never output plaintext to untrusted memory). Implement side-channel mitigations: constant-time algorithms, page fault protection, cache flushing. Use the AES and hash tools for sealing and verification.

   入力

   secret: db_encryption_key

   输出

   sealed: Seal(key) -> encrypted blob stored on disk | unsealed only by same enclave

期待される結果

機密性の高いコードとデータをハードウェア分離メモリで保護するセキュアエンクレーブ。リモートアテステーションでエンクレーブの完全性を証明し、永続シークレットにはシーリングを適用します。

よくあるエラー

Putting too much code in the enclave

Minimize the trusted computing base. Only security-critical code belongs in the enclave. Large code increases attack surface and side-channel exposure.

Not validating inputs at the enclave boundary

The host is untrusted. Validate every ECALL input: check lengths, ranges, and types. A buffer overflow in the enclave compromises all its secrets.

Ignoring side-channel attacks

SGX is vulnerable to cache, branch prediction, and page fault side channels. Use constant-time algorithms, ORAM for memory access patterns, and SGX2 with page fault protection where available.

トラブルシューティング指引

• If attestation fails, verify the enclave binary matches the expected measurement, the platform supports the TEE, and the attestation service is reachable.
• If enclave performance is slow, minimize enclave transitions (batch operations), use untrusted memory for non-sensitive data, and only enter the enclave for cryptographic operations.
• For SGX, ensure the BIOS has SGX enabled and EPC (Enclave Page Cache) size is sufficient for your enclave.

セキュリティ上の制限

• Secure enclaves protect against software attacks but have physical side-channel limitations. Recent CPU vulnerabilities (Spectre, Foreshadow) have broken some enclave assumptions.
• The enclave trusts the CPU manufacturer. If the hardware backdoor exists, enclave protection is void.
• All sensitive computation happens inside the enclave; the host OS and hypervisor cannot observe enclave memory contents.