论文标题
SGX飞地的二进制兼容性
Binary Compatibility For SGX Enclaves
论文作者
论文摘要
Enclaves，例如由英特尔SGX启用的飞地，为应用程序分区提供了强大的硬件隔离原始性。为了在未来的商品上普遍使用，飞地设计应与现有软件提供兼容性。在本文中，我们将注意力集中在SGX中的5个设计决策中，这与现有软件造成了不相容。我们希望这些代表具体的起点，以改进未来的T恤。此外，尽管许多先前的作品提供了部分兼容性，但我们提出了首次尝试与SGX上现有软件的二进制兼容性。我们提出了Ratel，该系统可以在Linux上启用SGX飞地内部动态二进制翻译引擎。通过Ratel的镜头，我们公开了OS- Lave界面上的性能与完全调解之间的基本权衡，该界面植根于上述5个SGX设计限制。我们报告了200多个计划对Ratel的广泛评估，包括微基准和Linux实用程序等实际应用。
Enclaves, such as those enabled by Intel SGX, offer a powerful hardware isolation primitive for application partitioning. To become universally usable on future commodity OSes, enclave designs should offer compatibility with existing software. In this paper, we draw attention to 5 design decisions in SGX that create incompatibility with existing software. These represent concrete starting points, we hope, for improvements in future TEEs. Further, while many prior works have offered partial forms of compatibility, we present the first attempt to offer binary compatibility with existing software on SGX. We present Ratel, a system that enables a dynamic binary translation engine inside SGX enclaves on Linux. Through the lens of Ratel, we expose the fundamental trade-offs between performance and complete mediation on the OS-enclave interface, which are rooted in the aforementioned 5 SGX design restrictions. We report on an extensive evaluation of Ratel on over 200 programs, including micro-benchmarks and real applications such as Linux utilities.
