A Formal Framework for State Continuity of Protected Modules

With system crashes or power failures, state-continuity solutions ensure the state of protected modules, e.g., enclaves of Intel SGX, cannot be rolled back to a stale version. In this paper, we propose a general framework for formally modeling and verifying the state-continuity solutions. The framework supports solutions that use different security strategies, such as strategies based on hash values or monotonic counters. We first propose a general model for state-continuity solutions. The general model contains an adversary that controls not only the OS but also the power of the system, and common actions of the solutions for ensuring state continuity. Then, we propose a general refinement strategy to refine the general model to models of concrete solutions. If the model of a concrete solution can be refined from the general model by using the strategy, the solution ensures state continuity. We implement the framework in the Coq proof assistant, and demonstrate that a solution, called Memior, guarantees state continuity for protected modules.