Protecting Security-Sensitive Data Using Program Transformation and Intel SGX

Cloud computing allows clients uploading their sensitive data to the public cloud and perform sensitive computations in those untrusted areas, which drives to possible violations to the confidentiality of client sensitive data. By leveraging the program transformation and the Intel Software Guard Extension (SGX) technology, our proposed solution hides the security-sensitive statements inside an SGX enclave. Some former works have shown that most applications can run in their entirety inside trusted areas such as SGX enclaves, and that leads to a large trusted computing base (TCB). As a result, we analyze a case study in which we partition an application and use an SGX enclave to protect only security-sensitive statements, thus obtaining a smaller TCB. In this paper, we describe our case study that secures applications written in Java using Intel SGX technology. We analyzed our proposed solution using concrete examples to show how the confidentiality of security-sensitive variables is protected.