Description
Outsourcing data computations to a cloud provider is a common way to process large datasets. However, a user might not trust the cloud provider with sensitive data, and enclaves are a promising way to ensure data confidentiality and integrity. In distributed applications, we can place code that affects data flow but not the data content outside of the enclave; we can then verify the correctness of the data flow execution. However, there are no existing frameworks to perform this verification.
We propose an execution flow verification library. Our library contributes (i) a way to securely log inputs and outputs of enclave functions, (ii) a verification strategy based on a ruleset specification and (iii) automatic API integration and ruleset generation. This saves developers from having to write their own custom application-specific verification code.
Our library provides data flow integrity, at the cost of a reasonable code footprint of about 500 lines and a latency overhead of roughly 3%.