Is the following is possible using SGX?

Hi @llly, can I ask your advice on using SGX enclaves?

would the following architecture using SGX be possible:

Consider 3 nodes:

1. Service Node
2. Enclave Node (has SGX Enclave)
3. ISV Node with API.

The workflow would be:

1. The Service node establishes comms with the Enclave node, which proves it is a valid Enclave running the previously provided software (presumably using SGX quote).
2. The Service node, on establishing that the Enclave is trustworthy sends a task request to the Enclave Node.
3. As part of the task request, the Enclave node is required to call an API on the ISV node. That ISV node would be provided with software which can perform the same Enclave challenge as the service node to establish that the Enclave node is a trusted SGX Enclave running the correct software and hence a valid 'agent' of the Service node, which would be sufficient trust to process the API request which may be a state change.

My main questions are:

- Is it possible to function in this way?
- Does the Service or ISV node need to be running the validation within an SGX Enclave to validate the Enclave node?