TWC: Medium: Collaborative: Systems, Tools, and Techniques for Executing, Managing, and Securing SGX Programs

英特尔软件保护扩展(SGX)是一项新技术，旨在使恶意环境中的安全和可信计算变得实用。然而，新交所只是一套指令而已。它的软件支持，包括操作系统支持、工具链和库，目前是以封闭的方式开发的，将其影响限制在英特尔和微软等大公司的边界内。同时，SGX并不能自动保护一切，它仍然面临着各种攻击，如受控端通道和Enclave内存损坏。本研究研究如何使应用程序开发人员能够安全地使用SGX指令，并提供包括工具链、编程抽象(如库)和操作系统支持(如内核模块)在内的开源软件支持。此外，本研究系统地探索了从飞地本身保护SGX程序并从底层操作系统挫败对SGX的恶意使用所需的系统和软件防御。

The Intel Software Guard Extensions (SGX) is a new technology introduced to make secure and trustworthy computing in a hostile environment practical. However, SGX is merely just a set of instructions. Its software support that includes the OS support, toolchain and libraries, is currently developed in a closed manner, limiting its impact only within the boundary of big companies such as Intel and Microsoft. Meanwhile, SGX does not automatically secure everything and it still faces various attacks such as controlled-side channel and enclave memory corruption.This research investigates how to enable application developers to securely use the SGX instructions, with an open source software support including a toolchain, programming abstractions (e.g., library), and operating system support (e.g., kernel modules). In addition, this research systematically explores the systems and software defenses necessary to secure the SGX programs from the enclave itself and defeat the malicious use of SGX from the underlying OS.