Eleos: Exit-Less OS Services for SGX Enclaves Meni Orenbach Marina - - PowerPoint PPT Presentation

▶
eleos exit less os services for sgx enclaves
SMART_READER_LITE
LIVE PREVIEW

Eleos: Exit-Less OS Services for SGX Enclaves Meni Orenbach Marina - - PowerPoint PPT Presentation

Feb 29, 2024 145 likes •1.02k views

Eleos: Exit-Less OS Services for SGX Enclaves Meni Orenbach Marina Minkin Pavel Lifshits Mark Silberstein Accelerated Computing Systems Lab Haifa, Israel What do we do? Improve performance: I/O intensive & memory demanding SGX enclaves

slide-1
SLIDE 1

Eleos: Exit-Less OS Services for SGX Enclaves

Meni Orenbach Marina Minkin Pavel Lifshits Mark Silberstein Accelerated Computing Systems Lab

Haifa, Israel

slide-2
SLIDE 2

22 May@Systor' 2017 Meni Orenbach, Technion 2

What do we do?

Improve performance: I/O intensive & memory demanding SGX enclaves

Why?

Cost of SGX execution for these applications is high

How?

In-enclave System Calls & User Managed Virtual Memory

Results

Eleos vs vanilla SGX

2x Throughput: memcached & face verification servers Even for 5x available enclave memory

Available for Linux, Windows* (*) Without Eleos, these applications crash in Windows enclaves

slide-3
SLIDE 3

22 May@Systor' 2017 Meni Orenbach, Technion 3

  • Background
  • Motivation
  • Overhead analysis
  • Eleos design
  • Evaluation
slide-4
SLIDE 4

22 May@Systor' 2017 Meni Orenbach, Technion 4

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

slide-5
SLIDE 5

22 May@Systor' 2017 Meni Orenbach, Technion 5

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

slide-6
SLIDE 6

22 May@Systor' 2017 Meni Orenbach, Technion 6

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

slide-7
SLIDE 7

22 May@Systor' 2017 Meni Orenbach, Technion 7

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

slide-8
SLIDE 8

22 May@Systor' 2017 Meni Orenbach, Technion 8

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

slide-9
SLIDE 9

22 May@Systor' 2017 Meni Orenbach, Technion 9

SGX enclaves are already here!

  • Secured execution environment
  • Reversed sandbox
  • Small TCB
  • Private code & data

– Confidentiality – Integrity – Freshness

  • Only CPU is trusted

Operating system Application Enclave Enclave

Lets look at How to secure server applications with enclaves

slide-10
SLIDE 10

22 May@Systor' 2017 Meni Orenbach, Technion 10

Background: Lifetime of a secured server

Untrusted (Host & OS) Trusted (Enclave)

slide-11
SLIDE 11

22 May@Systor' 2017 Meni Orenbach, Technion 11

Untrusted memory Unsecured access

Background: Lifetime of a secured server

Untrusted (Host & OS) Trusted (Enclave)

slide-12
SLIDE 12

22 May@Systor' 2017 Meni Orenbach, Technion 12

Untrusted memory Unsecured access

Background: Lifetime of a secured server

Untrusted (Host & OS) Trusted (Enclave)

Dedicated SGX mem Limited to: 128 MB Secured access

slide-13
SLIDE 13

22 May@Systor' 2017 Meni Orenbach, Technion 13

Wait for network requests

Background: Lifetime of a secured server

Host app

Untrusted (Host & OS) Trusted (Enclave)

slide-14
SLIDE 14

22 May@Systor' 2017 Meni Orenbach, Technion 14

Wait for network requests

Background: Lifetime of a secured server

Host app

Untrusted (Host & OS) Trusted (Enclave)

slide-15
SLIDE 15

22 May@Systor' 2017 Meni Orenbach, Technion 15

Wait for network requests

Background: Lifetime of a secured server

Decrypt requests

Enter enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

slide-16
SLIDE 16

22 May@Systor' 2017 Meni Orenbach, Technion 16

Wait for network requests

Background: Lifetime of a secured server

Decrypt requests

Enter enclave

Process requests

Host app

Untrusted (Host & OS) Trusted (Enclave)

slide-17
SLIDE 17

22 May@Systor' 2017 Meni Orenbach, Technion 17

Wait for network requests

Background: Lifetime of a secured server

Decrypt requests

Enter enclave

Process requests

Host app

Encrypt responses

Untrusted (Host & OS) Trusted (Enclave)

slide-18
SLIDE 18

22 May@Systor' 2017 Meni Orenbach, Technion 18

Send responses Wait for network requests

Background: Lifetime of a secured server

Decrypt requests

Enter enclave

Process requests

Exit enclave Host app

Encrypt responses

Untrusted (Host & OS) Trusted (Enclave)

slide-19
SLIDE 19

22 May@Systor' 2017 Meni Orenbach, Technion 19

SGX enclaves should be fast

  • ISA extensions
  • Implemented in HW & Firmware
  • Same CPU HW
  • In-cache execution suffers no overheads
slide-20
SLIDE 20

22 May@Systor' 2017 Meni Orenbach, Technion 20

SGX enclaves should be fast

  • ISA extensions
  • Implemented in HW & Firmware
  • Same CPU HW
  • In-cache execution suffers no overheads

However...

slide-21
SLIDE 21

22 May@Systor' 2017 Meni Orenbach, Technion 21

Executing a Key-Value Store in enclave is slower

slide-22
SLIDE 22

22 May@Systor' 2017 Meni Orenbach, Technion 22

64 MB 512 MB 5 10 15 20 25 30 35 40 Memory footprint

Executing a Key-Value Store in enclave is slower

Throughput: Slowdown factor

11X 34X

slide-23
SLIDE 23

22 May@Systor' 2017 Meni Orenbach, Technion 23

64 MB 512 MB 5 10 15 20 25 30 35 40 Memory footprint

Executing a Key-Value Store in enclave is slower

Throughput: Slowdown factor

11X 34X

Crashes in Windows

slide-24
SLIDE 24

22 May@Systor' 2017 Meni Orenbach, Technion 24

  • Background
  • Motivation
  • Overhead analysis
  • Eleos design
  • Evaluation
slide-25
SLIDE 25

22 May@Systor' 2017 Meni Orenbach, Technion 25

Send responses Wait for network requests

Overhead analysis

Enter enclave Exit enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

Decrypt requests 150 cycles/32B Process requests

*100 cycles/32B

Encrypt responses

*150 cycles/32B

slide-26
SLIDE 26

22 May@Systor' 2017 Meni Orenbach, Technion 26

Overhead analysis

Enter enclave Exit enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

Send responses Wait for network requests

Enter enclave Exit enclave Host app

Decrypt requests 150 cycles/32B Process requests

*100 cycles/32B

Encrypt responses

*150 cycles/32B

~3,300 cycles

slide-27
SLIDE 27

22 May@Systor' 2017 Meni Orenbach, Technion 27

Overhead analysis

Enter enclave Exit enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

Send responses Wait for network requests

Enter enclave Exit enclave Host app

Decrypt requests

150 cycles/32B

Process requests

*100 cycles/32B

Encrypt responses

*150 cycles/32B

~3,300 cycles ~3,800 cycles

slide-28
SLIDE 28

22 May@Systor' 2017 Meni Orenbach, Technion 28

Overhead analysis

Enter enclave Exit enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

Send responses Wait for network requests

Enter enclave Exit enclave Host app

Decrypt requests 150 cycles/32B Process requests

*100 cycles/32B

Encrypt responses

*150 cycles/32B

~3,300 cycles ~3,800 cycles Exits causes indirect costs: 1.5X – 5X slower execution FlexSC [OSDI'10] syscall analysis

slide-29
SLIDE 29

22 May@Systor' 2017 Meni Orenbach, Technion 29

Overhead analysis

Enter enclave Exit enclave Host app

Untrusted (Host & OS) Trusted (Enclave)

Send responses Wait for network requests

Enter enclave Exit enclave Host app

Decrypt requests 150 cycles/32B Process requests

*100 cycles/32B

Encrypt responses

*150 cycles/32B

~3,300 cycles ~3,800 cycles Exits causes indirect costs: 1.5X – 5X slower execution FlexSC [OSDI'10] syscall analysis

slide-30
SLIDE 30

22 May@Systor' 2017 Meni Orenbach, Technion 30

Eleos does better!

64 MB 512 MB 5 10 15 20 25 30 35 40 SGX Eleos Memory footprint

3.5x 5x

Throughput: Slowdown factor

slide-31
SLIDE 31

22 May@Systor' 2017 Meni Orenbach, Technion 31

Eleos does better!

64 MB 512 MB 5 10 15 20 25 30 35 40 SGX Eleos Memory footprint

3.5x 5x

How does Eleos achieve this?

Throughput: Slowdown factor

slide-32
SLIDE 32

22 May@Systor' 2017 Meni Orenbach, Technion 32

Eleos: Exit-less services

Exit-less system calls with RPC infrastructure Exit-less SGX paging

slide-33
SLIDE 33

22 May@Systor' 2017 Meni Orenbach, Technion 33

Eleos: Exit-less services

Exit-less system calls with RPC infrastructure Exit-less SGX paging

slide-34
SLIDE 34

22 May@Systor' 2017 Meni Orenbach, Technion 34

Background: SGX paging

System mem SGX mem Dedicated memory Enclave code & data Limited to 128 MB

slide-35
SLIDE 35

22 May@Systor' 2017 Meni Orenbach, Technion 35

Background: SGX paging

System mem

secret_foo(): ... *p = 1;

SGX mem Enclave Trusted Untrusted

slide-36
SLIDE 36

22 May@Systor' 2017 Meni Orenbach, Technion 36

Background: SGX paging

System mem

secret_foo(): ... *p = 1;

SGX mem Hardware Address translation Enclave Trusted Untrusted

slide-37
SLIDE 37

22 May@Systor' 2017 Meni Orenbach, Technion 37

Background: SGX paging

System mem

secret_foo(): ... *p = 1;

Encrypted SGX mem Page table Hardware Address translation Enclave Trusted Untrusted

slide-38
SLIDE 38

22 May@Systor' 2017 Meni Orenbach, Technion 38

Background: SGX paging

System mem

secret_foo(): ... *p = 1;

Encrypted SGX mem Page table Hardware Address translation Swapped-out Enclave Trusted Untrusted

slide-39
SLIDE 39

22 May@Systor' 2017 Meni Orenbach, Technion 39

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1;

Encrypted SGX mem Page table Hardware Address translation Swapped-out Enclave Trusted Untrusted SGX-driver

slide-40
SLIDE 40

22 May@Systor' 2017 Meni Orenbach, Technion 40

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1;

Encrypted

Integrity validation Decrypted

SGX mem Page table Hardware Address translation Swapped-out Enclave Trusted Untrusted SGX-driver

slide-41
SLIDE 41

22 May@Systor' 2017 Meni Orenbach, Technion 41

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted

slide-42
SLIDE 42

22 May@Systor' 2017 Meni Orenbach, Technion 42

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Fast path

slide-43
SLIDE 43

22 May@Systor' 2017 Meni Orenbach, Technion 43

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted

Since SGX memory is small paging is not as rare as in native applications What are the overheads?

Fast path

slide-44
SLIDE 44

22 May@Systor' 2017 Meni Orenbach, Technion 44

Background: SGX paging

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted

slide-45
SLIDE 45

22 May@Systor' 2017 Meni Orenbach, Technion 45

SGX paging overheads

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Enclave resume Enclave exit

slide-46
SLIDE 46

22 May@Systor' 2017 Meni Orenbach, Technion 46

SGX paging overheads

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Enclave resume Enclave exit Indirect costs

slide-47
SLIDE 47

22 May@Systor' 2017 Meni Orenbach, Technion 47

SGX paging overheads

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Enclave resume Enclave exit Overaheads: Untrusted software manages enclave memory Indirect costs

slide-48
SLIDE 48

22 May@Systor' 2017 Meni Orenbach, Technion 48

SGX paging overheads

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Enclave resume Enclave exit Overaheads: Untrusted software manages enclave memory Indirect costs

slide-49
SLIDE 49

22 May@Systor' 2017 Meni Orenbach, Technion 49

Wanted: In-enclave virtual memory management

No more exits!

slide-50
SLIDE 50

22 May@Systor' 2017 Meni Orenbach, Technion 50

Ideal in-enclave VM management

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

SGX mem Page table Hardware Address translation Enclave Trusted SGX driver Untrusted Hardware Address translation

slide-51
SLIDE 51

22 May@Systor' 2017 Meni Orenbach, Technion 51

Ideal in-enclave VM management

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

SGX mem Page table Hardware Address translation Enclave Trusted Hardware Address translation

slide-52
SLIDE 52

22 May@Systor' 2017 Meni Orenbach, Technion 52

Ideal in-enclave VM management

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

SGX mem Page table Hardware Address translation Enclave Trusted Hardware Address translation

No available hardware

slide-53
SLIDE 53

22 May@Systor' 2017 Meni Orenbach, Technion 53

Ideal in-enclave VM management

System mem Fault handler

secret_foo(): ... *p = 1; *(++p) = 2;

SGX mem Page table Hardware Address translation Enclave Trusted Software Address translation

slide-54
SLIDE 54

22 May@Systor' 2017 Meni Orenbach, Technion 54

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

SGX mem Page table Enclave Trusted Software Address translation

slide-55
SLIDE 55

22 May@Systor' 2017 Meni Orenbach, Technion 55

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

slide-56
SLIDE 56

22 May@Systor' 2017 Meni Orenbach, Technion 56

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

Encrypted SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

slide-57
SLIDE 57

22 May@Systor' 2017 Meni Orenbach, Technion 57

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

Encrypted SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

Swapped-out

slide-58
SLIDE 58

22 May@Systor' 2017 Meni Orenbach, Technion 58

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

Encrypted SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

Swapped-out

slide-59
SLIDE 59

22 May@Systor' 2017 Meni Orenbach, Technion 59

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

Encrypted

Decrypted

SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

Swapped-out

Integrity validation

slide-60
SLIDE 60

22 May@Systor' 2017 Meni Orenbach, Technion 60

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1;

Encrypted

Decrypted

SGX mem Page table Enclave Trusted Software Address translation

Template class: SecuredPointer.

Swapped-out

Integrity validation

Control path in-enclave

slide-61
SLIDE 61

22 May@Systor' 2017 Meni Orenbach, Technion 61

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Enclave Trusted Software Address translation

slide-62
SLIDE 62

22 May@Systor' 2017 Meni Orenbach, Technion 62

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Enclave Trusted Software Address translation

slide-63
SLIDE 63

22 May@Systor' 2017 Meni Orenbach, Technion 63

SUVM: Secured user-space VM

System mem Fault handler

secret_foo(): s_ptr<int> p = suvm_malloc(1024); ... *p = 1; *(++p) = 2;

Encrypted

Decrypted

SGX mem Page table Enclave Trusted Software Address translation

Fast path No page table Lookup!

slide-64
SLIDE 64

22 May@Systor' 2017 Meni Orenbach, Technion 64

Wait...Software based VM management?

Based on software address translation

  • n GPUs, ActivePointers [ISCA'2016]
slide-65
SLIDE 65

22 May@Systor' 2017 Meni Orenbach, Technion 65

SUVM key contributions

  • Multi-threaded

Compared to SGX: Fast path: up to 20% overheads Slow path: Eliminates costs of exits 1 Thread 4 Threads READ 5.5x 7x WRITE 3.5x 5.9x

Throughput speedup

slide-66
SLIDE 66

22 May@Systor' 2017 Meni Orenbach, Technion 66

Software address translation

  • ffers new optimizations
  • Customized page size
  • Customized eviction policy
  • Multi-enclave memory coordination
  • Write-back only dirty pages
  • Sub-page direct access to backing store
slide-67
SLIDE 67

22 May@Systor' 2017 Meni Orenbach, Technion 67

Software address translation

  • ffers new optimizations
  • Customized page size
  • Customized eviction policy
  • Multi-enclave memory coordination
  • Write-back only dirty pages
  • Sub-page direct access to backing store

Virtual Machine ballooning

slide-68
SLIDE 68

22 May@Systor' 2017 Meni Orenbach, Technion 68

Software address translation

  • ffers new optimizations
  • Customized page size
  • Customized eviction policy
  • Multi-enclave memory coordination
  • Write-back only dirty pages
  • Sub-page direct access to backing store

Virtual Machine ballooning

slide-69
SLIDE 69

22 May@Systor' 2017 Meni Orenbach, Technion 69

  • Background
  • Motivation
  • Overhead analysis
  • Eleos design
  • Evaluation
slide-70
SLIDE 70

22 May@Systor' 2017 Meni Orenbach, Technion 70

Biometric Identity checking server

Face verification server Workload generator

? =

450MB DB (5X SGX mem)

+ ID

10Gb NIC

slide-71
SLIDE 71

22 May@Systor' 2017 Meni Orenbach, Technion 71

1 2 4 0.5 1 1.5 2 2.5 3 3.5 Eleos Native Server threads

Biometric Identity validating server

Speedup compared to vanilla SGX

slide-72
SLIDE 72

22 May@Systor' 2017 Meni Orenbach, Technion 72

1 2 4 0.5 1 1.5 2 2.5 3 3.5 Eleos Native Server threads

Biometric Identity validating server

Speedup compared to vanilla SGX

slide-73
SLIDE 73

22 May@Systor' 2017 Meni Orenbach, Technion 73

1 2 4 0.5 1 1.5 2 2.5 3 3.5 Eleos Native Server threads

Biometric Identity validating server

Speedup compared to vanilla SGX

Eleos scales better than vanilla-SGX: Saves inter-processor-interrupts

slide-74
SLIDE 74

22 May@Systor' 2017 Meni Orenbach, Technion 74

1 2 4 0.5 1 1.5 2 2.5 3 3.5 Eleos Native Server threads

Biometric Identity validating server

Speedup compared to vanilla SGX

Eleos scales better than vanilla-SGX: Saves inter-processor-interrupts Saturate 10Gb network

slide-75
SLIDE 75

22 May@Systor' 2017 Meni Orenbach, Technion 75

Memcached

Workload Generator (memaslap)

GET( )

~75 LOC modification for SUVM

Memcached Graphene LibOS [Eurosys'2014]

500MB DB (5.5X SGX mem) 10Gb NIC

slide-76
SLIDE 76

22 May@Systor' 2017 Meni Orenbach, Technion 76

1 Thread 4 Threads 0.5 1 1.5 2 2.5 3 E l e

  • s

( 5 MB D B ) v a n i l l a S G X ( 2 MB D B ) Server threads

Memcached

Speedup compared to vanilla SGX (500 MB)

No SGX Faults No SGX Faults

slide-77
SLIDE 77

22 May@Systor' 2017 Meni Orenbach, Technion 77

1 Thread 4 Threads 0.5 1 1.5 2 2.5 3 E l e

  • s

( 5 MB D B ) v a n i l l a S G X ( 2 MB D B ) Server threads

Memcached

Speedup compared to vanilla SGX (500 MB)

Disclaimer: Eleos+Graphene is 3x slower than native No SGX Faults No SGX Faults

slide-78
SLIDE 78

22 May@Systor' 2017 Meni Orenbach, Technion 78

Take aways

  • Eleos eliminates enclave exits costs
  • Eleos available for Windows and Linux

– Makes memory demanding applications available

  • n Windows today
  • Eleos takes a modularize approach

– Memory demanding app? Link to SUVM – I/O intensive app? Link to RPC – Maintaining small TCB

slide-79
SLIDE 79

22 May@Systor' 2017 Meni Orenbach, Technion 79

Traditional SGX: Host-centric OS services

Enclave Operating System

slide-80
SLIDE 80

22 May@Systor' 2017 Meni Orenbach, Technion 80

Traditional SGX: Host-centric OS services

Enclave Operating System

Get data

slide-81
SLIDE 81

22 May@Systor' 2017 Meni Orenbach, Technion 81

Traditional SGX: Host-centric OS services

Enclave Operating System

Get data Data Unavailable

slide-82
SLIDE 82

22 May@Systor' 2017 Meni Orenbach, Technion 82

Traditional SGX: Host-centric OS services

Enclave Operating System

Fetch data Get data Data Unavailable

slide-83
SLIDE 83

22 May@Systor' 2017 Meni Orenbach, Technion 83

Traditional SGX: Host-centric OS services

Enclave Operating System

Fetch data Get data Data Unavailable

slide-84
SLIDE 84

22 May@Systor' 2017 Meni Orenbach, Technion 84

Eleos Insight: Enclave-centric OS services

Enclave

Get data Fetch data

In-enclave Services

slide-85
SLIDE 85

22 May@Systor' 2017 Meni Orenbach, Technion 85

Take aways (2)

  • Eleos adapts 'accelerator-centric management'

– System calls: GPUfs [ASPLOS'13], GPUnet [OSDI'14] – Virtual memory: ActivePointers [ISCA'16]

  • We can do more!

– Asynchronous DMA host copies – Non-blocking enclave launches

More information at: “SGX Enclaves as Accelerators" [Systex'16]

slide-86
SLIDE 86

22 May@Systor' 2017 Meni Orenbach, Technion 86

Thank you Code is available at:

https://github.com/acsl-technion/eleos

shmeni@tx.technion.ac.il

slide-87
SLIDE 87

22 May@Systor' 2017 Meni Orenbach, Technion 87

Backup slides