Open bradyjoestar opened 5 years ago
Really good idea!
I think it's a pretty good start of a protected db. The sample code will be a fantastic proof-of-concept.
To use it in production, one needs to consider about authentication and authorization.
yeah!it's may be more useful if we consider the persistence of protected db.:beers:
Maybe we could directly try to support kvdb
in enclave? It includes kvdb-memdb
and kvdb-rocksdb
which from paritytech/parity-commons
.
At the same time we would provide two examples:
This is used to show how to save some data which we want to be reused for a long time, such as the tls keypair.
This is used to show how to use rocksdb as protected db, we may need to solve the following problems:
@bradyjoestar @dingelish for the persistent (e.g. rocksdb) backend, one additional problem would be freshness -- one could overwrite the db state with an old authentic and encrypted state. As this is for "cloud" web apps (https://github.com/baidu/rust-sgx-sdk/issues/110 ) Intel ME functionality (like monotonic counters) that could help may not be available.
I guess a more "cloud-friendly" alternative for persistent db freshness would be some fault-tolerant enclave kvdb replication?
Just noticed that parity’s kvdb-memorydb is under GPLv3. Do we really need to depend on this?
I think I need to fork parity-common to another repo instead of place them in this repo.
Assigned to myself.
Sure!
I guess a more "cloud-friendly" alternative for persistent db freshness would be some fault-tolerant enclave kvdb replication?
@tomtau I'm not proficient in database so give me some time to learn :smile: Thanks to your suggestion and I will read the paper carefully.
I want to support
memdb
for rust-sgx-sdk and at the same time writing a sample which works in the following ways:set
function, it will write the data into thememdb
get
function, it will read the data frommemdb
.Is this feasible in theory? If true, I'd like to be reviewed and merged. :smile: