可信硬件加密方案——Intel SGX和Apple SEP

摘自 https://blog.decentriq.ch/soft-introduction-to-secure-crytpographic-enclaves/
从数据隔离——》数据隐私保护。

When Apple released the iPhone 5S in 2013, most people focused on its new camera and features such as Touch ID. However, on top of these features, Apple introduced what was meant to be a very influential idea on the cryptography world. Underpinning Touch ID, the Secure Enclave Processor (SEP) was presented as a separate sub processor that would store sensitive data and run computer programs on top of it. The sensitive data could never be accessed by the regular CPU. The design and inner workings were kept secret by Apple who released only sparse information on the internals. More recently, Intel also started offering such a feature on its desktop CPUs named Intel Software Guard Extensions, or SGX for short. Below we provide a short summary of why this technology is useful, and how it works.

There are currently two types of implementations for enclaves. The Apple implementation and the Intel implementation. Apple’s approach is based on a physical separation between the CPU and the secondary secure processor (they are located in different sections on the motherboard). The Intel implementation relies on additional CPU instructions and trusted hardware, which hosts the confidential data and the software to be used on the data. Both of these implementations, however, attempt to accomplish the same goal. That is, to isolate some data and computation from the rest of the system giving access only to agents with privileged rights. In simple words, you have a box in which you can execute whatever program you want using arbitrary data and be assured that the data that has been used in there will not be seen by anyone else except those that have the rights to see it, while also receiving a guarantee that the program running on your data is the intended one.