Using SGX and UUID to avoid Sybil attacks

[Ron__Eyal]

Hello,

We're working on a project where we have a problem of one user pretending to be many users, just by installing our software many times on the same computer (Sybil attack).

Is it possible to mitigate it using SGX and UUID? What we had in mind is the software creates an enclave, and then sends our server the UUID of the processor running it. That way, we can identify that the user runs two processes of our software on the same computer.

We're aware that there may be privacy issues with such an approach, but so far we want just to know if such a thing is possible at all.

Is there a limitation for enclaves to send UUID through the network? Or can it be easily manipulated by the user? Our software is open source.

[Yan_M_1]

What you can do is use remote attestation with Linkable mode, which would enable you to assess whether the same machine is authenticating to your server.