< Back

From Wasm-SGX to Gramine-SGX: Simplifying the TEE-fication of Credit Scoring in Crypto Finance

June 6, 4:25 PM - 4:45 PM
Imperial Room A

Credit scoring has been historically used by financial institutions to estimate the risk of lending money to an individual. It determines the ability of an entity to repay debts based on a number of quantitative and qualitative metrics. High credit scores lead to higher chances of obtaining a loan with low-interest rates. Conversely, entities with a lower credit score must pay higher interest rates on their loans. The Credora Inc. company provides a privacy-preserving scoring solution for credit in crypto-currency finance. With more than $100B of crypto collateral being used to generate more than $1.25B of interest on a quarterly basis, credit is one of the most rapidly growing sectors of the emerging crypto-currency finance ecosystem. Credora Inc. allows borrowers to supply lenders with real-time portfolio risk metrics while preserving the privacy of trades, positions, and other sensitive information. Borrowers benefit from improved lending terms, as they can display their risk in real time and assure lenders they are trading responsibly. Lenders benefit from increased visibility and real-time information.

The fundamental requirement of the Credora solution is that users' confidential data remains private and is computed correctly, e.g., metrics must reflect the actual status of the credit. To this end, Credora Inc. uses TEE technologies to ensure users' sensitive data privacy and guarantee risk analysis. Intel SGX is the enabling TEE technology adopted to protect and attest sensitive processing because of its strong threat model to other VM-based TEE alternatives. Within the threat model supported by Intel SGX, only computations authorized by the user are allowed in the attested enclave, and no party can see granular private data or perform any knowledge extraction.

In this session, we will share our experience regarding the SGX integration. We started using WebAssembly with SGX because our goal was to also enable decentralized (and verifiable) computations. However, this kind of approach resulted in being error-prone and still not production-ready. It required too much engineering effort. Hence, we moved to Gramine SGX and completely restructured the infrastructure. Such an approach resulted in a much more stable and faster platform. We ported an Hashicorp Vault cluster inside Gramine and a widely-known python library (CCXT) interfacing with crypto finance exchange venues.

About the speaker

Giovanni Mazzeo

Giovanni Mazzeo

Confidential Computing Consultant, Credora Inc.

Giovanni Mazzeo, Ph.D., is a Confidential Computing Consultant at Credora Inc. and an Assistant Professor at the Department of Engineering of the University of Naples, Parthenope. His research focuses on the security and dependability of computer systems, with a particular focus on hardware-assisted trusted computing. He is the author or co-author of more than 30 peer-reviewed research papers.