Brief introduction: SQLite's Virtual File System

The Virtual File System of SQLite (VFS) serves as a layer between the file system and the SQLite database. This makes it possible to create your own implementations for various SQLite operations. Especially for non-trivial file systems or file systems with additional logic (e.g. Intel SGX Secure File API) or with synchronization mechanisms can be accessed via the SQLite library. Since SQLite is a file-based database system, the typical file functions of C must be newly implemented. In our case we will realize the integration of SGX compliant encryption and decryption of data by reimplementing the individual functions.

Due to the implementation of VFS it is possible to implement the Intel SGX operations for encryption and decryption of the database and temporary files. The binary streams from the VFS in the Enclave are passed to the Intel SGX functions for encryption and decryption.

The following diagram is an abstract representation of the VFS and Intel SGX implementation.

The following contribution was used as reference implementation. using-sqlite-with-stdiostream