Enclave fork support
A fork support is provided for duplicating an application running inside an enclave entity. In this regard, a request to duplicate an application running inside a first enclave may be received by one or more processors of a host computing device of the first enclave. A snapshot of the first enclave including the application may be generated. The snapshot may be encrypted with a snapshot key and copied to untrusted memory of the host. A second enclave may be generated. The snapshot key may be sent from the first enclave to the second enclave through a secure communication channel. The encrypted snapshot may be copied from the untrusted memory of the host into the second enclave. The encrypted snapshot may be decrypted inside the second enclave with the snapshot key.
1. A method comprising: encrypting, by one or more processors, an enclave instance with a first key inside a first enclave;
generating, by the one or more processors, a shared secret key inside the first enclave;
encrypting, by the one or more processors, the first key with the shared secret key inside the first enclave;
establishing, by the one or more processors, a secure communication channel between the first enclave and a second enclave using the shared secret key;
sending, by the one or more processors, the encrypted first key to the second enclave;
and copying, by the one or more processors, the encrypted enclave instance to the second enclave.
2. The method of claim 1 , further comprising outputting, by the one or more processors, the encrypted first key from the first enclave to a first process of a host.
3. The method of claim 1 , wherein the encrypted first key is sent to the second enclave through the secure communication channel.
4. The method of claim 1 , wherein the shared secret key comprises a public key paired with a private key.
5. The method of claim 1 , wherein the encrypted enclave instance is copied to untrusted memory allocated to a first process of a host.
6. The method of claim 5 , further comprising copying, by the one or more processors, the encrypted enclave instance from the untrusted memory allocated to the first process to untrusted memory allocated to a second process of the host.
7. The method of claim 5 , further comprising deleting, by the one or more processors, the encrypted enclave instance from the untrusted memory allocated to the first process.
8. The method of claim 1 , further comprising: decrypting, by the one or more processors, the encrypted first key with the shared secret key inside the second enclave; and decrypting, by the one or more processors, the encrypted enclave instance with the first key inside the second enclave.
9. A system comprising: one or more processors; and
one or more storage devices coupled to the one or more processors and storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
encrypting an enclave instance with a first key inside a first enclave;
generating a shared secret key inside the first enclave;
encrypting the first key with the shared secret key inside the first enclave;
establishing, by the one or more processors, a secure communication channel between the first enclave and a second enclave using the shared secret key;
sending the encrypted first key to the second enclave;
and copying the encrypted enclave instance to the second enclave.
10. The system of claim 9 , wherein the operations further comprise outputting the encrypted first key from the first enclave to a first process of a host.
11. The system of claim 1 , wherein the encrypted first key is sent to the second enclave through the secure communication channel.
12. The system of claim 9 , wherein the shared secret key comprises a public key paired with a private key.
13. The system of claim 9 , wherein the encrypted enclave instance is copied to untrusted memory allocated to a first process of a host.
14. The system of claim 13 , wherein the operations further comprise copying the encrypted enclave instance from the untrusted memory allocated to the first process to untrusted memory allocated to a second process of the host.
15. The system of claim 13 , wherein the operations further comprise deleting the encrypted enclave instance from the untrusted memory allocated to the first process.
16. The system of claim 9 , wherein the operations further comprise: decrypting the encrypted first key with the shared secret key inside the second enclave; and decrypting the encrypted enclave instance with the first key inside the second enclave.
17. A non-transitory computer readable medium for storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: encrypting an enclave instance with a first key inside a first enclave; generating a shared secret key inside the first enclave;
encrypting the first key with the shared secret key inside the first enclave;
establishing, by the one or more processors, a secure communication channel between the first enclave and a second enclave using the shared secret key;
sending the encrypted first key to a second enclave;
and copying the encrypted enclave instance to the second enclave.
18. The non-transitory computer readable medium of claim 17 , wherein the encrypted first key is sent to the second enclave through the secure communication channel.