Fortanix MySQL Demo.

Summary

This video showcases a MySQL server running with 10x runtime encryption technology, using secure Enclave technology for data protection. When the server launches, a unique Enclave hash identifies the code running within the secure environment. The server's memory is encrypted, with no access allowed to the OS or hypervisor. Interactions with the server, including creating tables and retrieving data, occur over a secure TLS channel. The video demonstrates how MySQL can operate securely in an isolated environment while maintaining normal functionality.

Takeaways

• 🔒 MySQL is running with Intel SGX support, providing enhanced security through enclaves.
• 🖥️ When the server launches, it prints Secure Enclave information to the terminal.
• 🆔 The Enclave hash uniquely identifies the code running inside the enclave.
• 🔑 The Enclave hash is used by hardware to derive encryption keys accessible only to this MySQL instance.
• 💾 All MySQL code and data reside in a memory region assigned to the SGX device and are transparently encrypted.
• 🚫 Neither the OS nor the hypervisor can access the plaintext contents of the enclave memory.
• 🌐 Clients interact with the server over standard TCP connections, just like a normal MySQL server.
• 📊 Users can create tables, insert data, and retrieve data normally while benefiting from secure enclaves.
• 🔐 All data exchanged between the client and MySQL enclave is sent over a secure TLS channel.
• 🛡️ The setup demonstrates confidential computing, protecting data in-use from unauthorized access, even from privileged system software.

Q & A

What technology is used to provide runtime encryption for MySQL in the video?

The video demonstrates MySQL running with Intel SGX (Secure Enclave) technology, providing 10x runtime encryption.

What is the purpose of the Enclave hash mentioned in the video?

The Enclave hash uniquely identifies the code running inside the secure enclave and is used by the hardware to derive encryption keys specific to that MySQL instance.

Can other applications access the encryption keys used by the MySQL enclave?

No, the encryption keys derived from the Enclave hash are accessible only to the MySQL instance running inside the enclave, ensuring isolation from all other applications.

How is MySQL memory protected when running inside the SGX enclave?

All MySQL code and data are located inside a memory region assigned to the SGX device, where the contents are transparently encrypted and inaccessible even to the OS or hypervisor.

Where in the system can we examine the memory mappings of the MySQL process?

The memory mappings can be examined in the `/proc` filesystem, which shows a large section of memory assigned to the SGX device.

How does client interaction with this secure MySQL instance work?

Clients can interact with the server over TCP like a standard MySQL server, performing operations such as creating tables, inserting data, and retrieving data.

Is the data transmitted between the client and the enclave encrypted?

Yes, all data transmitted between the client and the MySQL instance in the enclave is sent over a secure TLS channel.

Does the SGX enclave protect the data from the operating system and hypervisor?

Yes, the enclave encrypts memory contents in a way that prevents even the OS or hypervisor from accessing the plaintext data.

What is the main security benefit of running MySQL inside an SGX enclave?

The main benefit is the confidentiality and integrity of the data, as it is isolated from unauthorized access at the OS and hypervisor levels.

Can this secure MySQL instance be used like a normal MySQL server?

Yes, despite running inside a secure enclave, it functions like a standard MySQL server, supporting typical database operations.