Source code of the prototype presented in the paper Using Intel SGX to Protect Authentication Credentials in an Untrusted Operating System, presented at 23th IEEE Symposium on Computers and Communications (ISCC 2018).
We present a novel password file protection scheme, which uses Intel SGX to protect authentication credentials in the PAM authentication framework, commonly used in UNIX systems. We defined and implemented an SGX-enabled version of the pam_unix.so authentication module, called UniSGX. This module uses an SGX enclave to handle the credentials informed by the user and to check them against the password file. To add an extra security layer, the password file is stored using SGX sealing. Different scenarios were implemented to evaluate the overhead posed by protected memory, sealed file, and the overall overhead.
-
UniSGX no seal: The authentication is done inside the enclave, but the original unprotected credentials file is used.
-
UniSGX: Runs the UniSGX module prototype, including enclave instantiation, sealed data, and hashed passwords.
-
UniSGX no hash: Runs the UniSGX module prototype, including enclave instantiation, sealed data, but using a credentials file with unhashed passwords.
Source code of the prototype presented in the paper Using a Shared SGX Enclave in the UNIX PAM Authentication Service, presented at 14th Annual IEEE International Systems Conference (SysCon 2020).
Using SGX enclaves usually incurs in a performance impact in the application execution. We propose an enclave sharing approach to reduce the performance overhead in scenarios where multiple enclaves handle the same data. To evaluate this approach, we implemented a SGX-secured OS authentication service. Three prototypes were built, considering distinct concerns about security and performance.
-
UniSGX Authentication Service with Hard-coded AES Keys: The encryption key is hard-coded in the client and the enclave, and creates a secure communication channel between the client and the enclave.
-
UniSGX Authentication Service with ECDH Key Agreement: A session key for communication is defined by an Elliptic-Curve Diffie–Hellman (ECDH) key agreement scheme based on Curve25519.
-
UniSGX Authentication Service with Attestation: SGX local attestation is used to verify whether the UniSGX client process is running in the same platform as the server process.
Licenced under the GPL-3.0 License. If you make any use of this code for academic purpose, you must cite the papers.