Towards Securely MigratingWebAssembly Enclaves

Abstract

To run services in Trusted Execution Environments and Secure Enclaves is an established approach to protect privacy-sensitive data or payment processing. The increased importance of service elasticity in e.g. cloud computing, but also between edge and cloud, highlights the need of (hardware) architecture agnostic secure migration of such processing. We present an enclave software design, based on a WebAssembly (WASM) runtime, that allows for secure migration of enclave services with integrity and confidentiality guarantees for both enclave code and software state (data). We provide security analysis for our migration approach, and architecture benchmarking for a wide variety of existing (and future) secure enclave hardware as proof that elasticity in computation-without compromising security-is an achievable goal.