April 2023 Summaries

The blog post discusses the development of Cages, a generic enclave runtime designed to prioritize security and usability while abstracting the complexities of running services in Trusted Execution Environments (TEEs). It explains how Cages allow developers to build and deploy Enclave Image Files (EIFs) in their own environments using Docker, followed by deployment into Nitro Enclaves with Evervault processes handling traffic, health monitoring, and runtime configurations. The post details the unique trust model that ensures both the developers and Evervault can trust the Cages, using a combination of attestation documents, TLS handshakes, JWTs, and internal services to manage sensitive data securely. Usability is enhanced by simplifying the deployment process and integrating proxies to facilitate DNS queries and TCP connections, while also offering options for network restrictions. The overarching aim is to make TEEs accessible without sacrificing security or requiring significant engineering efforts, with ongoing updates and new features being added to improve control and functionality.

The text explores the evolution and significance of trusted execution environments (TEEs) in computing, emphasizing their role in ensuring the integrity and confidentiality of data processed remotely, especially in the context of cloud computing. As computer architectures transition from von Neumann to non-von Neumann models due to the limitations of the former, TEEs become crucial for isolating and attesting the core components like processors, memory, and I/O devices. The rise of open architectures such as RISC-V is highlighted as a pivotal development, allowing for standardized TEE implementations that overcome the proprietary constraints of traditional designs. This shift towards open standards is expected to foster innovation in application-specific TEEs, enhancing security across different computing platforms, from cloud servers to IoT devices. Additionally, Evervault Cages are presented as a means to facilitate trusted computations by providing a user-friendly interface for deploying applications in TEEs, akin to the portability offered by Docker containers. The document underscores the potential for TEEs to become ubiquitous, driven by the demands of confidential computing and the need for secure data handling in increasingly remote and resource-constrained environments.

API keys serve as crucial components in modern web applications, facilitating secure communication and data exchange between different services. However, they pose significant security risks if not managed properly, as unauthorized access can lead to data breaches and compromised user privacy. To mitigate these risks, it is essential to implement best practices for API key management, which include not committing keys to source control, securely storing them using environment variables or encryption services, limiting access based on the principle of least privilege, and regularly monitoring and rotating keys. Additionally, using secure communication protocols like HTTPS, conducting regular audits, and educating development teams on security protocols are vital for maintaining application security. Automating API key provisioning and revocation, integrating security measures throughout the development lifecycle, and establishing incident response procedures further enhance the protection of sensitive data and build trust with users. By adhering to these best practices, developers can ensure the safety and integrity of their applications.

The blog post details the creation of an abstraction layer that facilitates the development of applications for Nitro Enclaves without requiring custom modifications, particularly addressing the challenges posed by default lack of networking and complex traffic management via VSOCK. The authors introduce a control and data plane layer that allows simple TCP applications to run in an enclave within 15 minutes, utilizing a Network Load Balancer and Server Name Indication for secure TLS traffic routing. They developed a data plane to abstract VSOCK complexities, enabling apps to interact over TCP/HTTP, and established a seamless egress networking system for secure external communication while maintaining enclave isolation. The system includes an internal DNS server and egress proxy for managing domain access, with a focus on security by ensuring all traffic is encrypted and restricted to allowlisted domains to mitigate risks like typosquatting. The post emphasizes the open-source nature of the solution, encouraging users to try it with a free 14-day trial of Cages, and highlights that the system is designed to seamlessly handle app deployment while maintaining security through attestable features and optional egress capabilities.

Data security often emphasizes protecting data in transit or during processing, but securing data at rest is equally crucial due to its potential for serious breaches, which can be mitigated through encryption. Encryption transforms data into ciphertext using cryptographic keys, with symmetric encryption employing a single key for both encryption and decryption, and asymmetric encryption using a pair of keys. Common mistakes in encryption at rest include storing unnecessary data, using weak or improperly implemented encryption algorithms, misaligning encryption in the software architecture, and poor key management. Key management errors often involve storing keys alongside data, unclear usage, and failing to rotate keys. It's essential to ensure data security across all states—at rest, in use, and in transit—to prevent unauthorized access. Solutions like Evervault offer encryption platforms that manage data securely, allowing encrypted data storage without altering database configurations.

The blog post discusses the initialization of the Cage environment on Nitro Enclaves, focusing on features like TLS certificate provisioning and secrets management. It emphasizes the use of a Trusted Execution Environment (TEE) for secure operations, ensuring that the code running within is cryptographically verified. The Cage's TLS implementation is designed to ensure that traffic remains encrypted within the enclave, with a system in place for automatic certificate regeneration via a Certificate Authority (CA) created on startup. The process involves multiple security checks, including attestation document validation and environment variable management, to maintain data integrity and confidentiality. An on-enclave API is introduced to handle encryption, decryption, and attestation document retrieval, making Cages language agnostic and allowing applications written in any language to run securely. The post concludes by highlighting the flexibility offered to developers in managing environments and secrets, aiming to simplify the deployment of Dockerfiles to secure enclaves.

Evervault has recently introduced several updates and features to enhance the security and functionality of its offerings, focusing on securely storing API credentials and secrets, improving encryption speeds, and providing access to open-source code. With the migration to the SECP256R1 elliptic curve, encryption speed in E3 has improved fourfold, while the publicly available source code for Cages allows developers to verify the runtime and their processes within an enclave. New metrics for Cages enable users to monitor CPU and memory usage, and encrypt/decrypt operations in the dashboard. Additional updates include the support for HTTP header encryption, client IP preservation in Inbound Relay, and enhanced styling options for Inputs forms. Evervault Guides, a new documentation section, offers step-by-step guides for building encrypted solutions in various tech stacks, and the company has expanded its educational content with blog posts exploring topics like SHA-1 deprecation and the development of secure enclaves.

Deploying a Cage, a secure enclave server, involves a multi-step process designed to streamline and secure operations in a production environment. The process begins with the architecture of a Cage, comprising a control plane, data plane, and user process, each playing distinct roles to ensure effective communication and processing within the enclave. The deployment process includes uploading an Enclave Image File (EIF) to the Evervault infrastructure, building a Docker image incorporating the EIF and control plane using Kaniko, and programmatic deployment through AWS Step Functions, which manage interdependent infrastructure components. Key elements such as EC2 Auto Scaling Groups, ECS Services, and AWS Cloudmap are utilized for high availability, efficient resource management, and seamless service discovery and routing. Throughout the deployment, status updates and observability features like logs and metrics provide insights into the Cage's performance and security, with weekly security patches ensuring the system remains up to date. This comprehensive approach aims to simplify the deployment of Trusted Execution Environments, offering a user-friendly interface and robust security features.