Application progress of SGX in trusted computing area

Bo ZHAO; Anqi YUAN; Yang AN

doi:10.11959/j.issn.2096-109x.2021066

您当前的位置：

首页 >

文章列表页 >

Application progress of SGX in trusted computing area

Papers | 更新时间：2024-06-03

- Application progress of SGX in trusted computing area
- Chinese Journal of Network and Information Security Vol. 7, Issue 6, Pages: 126-142(2021)
- 作者机构：
  
  1. 武汉大学国家网络安全学院，湖北武汉 430072
  2. 武汉大学计算机学院，湖北武汉 430079
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021066
  CLC： TP311
- Online First：2021-12，
  
  Published：15 December 2021
- 稿件说明：
移动端阅览
Bo ZHAO, Anqi YUAN, Yang AN. Application progress of SGX in trusted computing area[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 126-142.
DOI：

Bo ZHAO, Anqi YUAN, Yang AN. Application progress of SGX in trusted computing area[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 126-142. DOI： 10.11959/j.issn.2096-109x.2021066.

摘要

可信计算技术 SGX 通过隔离出一块可信执行环境，来保护关键代码及数据的机密性与完整性，可以帮助防范各类攻击。首先，介绍了 SGX 的研究背景和工作原理，分析了 SGX 在可信计算领域的研究现状。然后，整理了 SGX 当前的应用难点和解决办法，并与其他可信计算技术进行了对比。最后，探讨了SGX技术在可信计算领域的发展方向。

Abstract

The trusted computing technology SGX protects the confidentiality and integrity of key codes and data by isolating a trusted execution environment

which can help prevent all kinds of attacks.Firstly

the research background and working principle of SGX were introduced

the research status of SGX in the field of trusted computing were analyzed.Then

sorted out the current application difficulties and solutions of SGX were sorted out and compared with other trusted computing technologies.Finally

SGX technology development direction in the field of trusted computing was discussed.

关键词

Keywords

references

Intel Corporation Intel Labs [EB ] .

BAUMANN A , PEINADO M , HUNT G C , et al . Shielding applications from an untrusted cloud with Haven [C ] // Operating systems Design and Implementation , 2014 : 267 - 283 .

ARNAUTOV S , TRACH B , GREGOR F , et al . SCONE:secure Linux containers with Intel SGX [C ] // Proc of the 12th USENIX Symp.on Operating Systems Design and Implementation(OSDI) . 2016 .

SCHUSTER F , COSTA M , FOURNET C , et al . VC3:trustworthy data analytics in the cloud using SGX [C ] // IEEE Symposium on Security ＆ Privacy . 2015 .

SHIH M W , KUMAR M , KIM T , et al . S-NFV:securing NFV states by using SGX [C ] // Proc of the 2016 ACM Int'l Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . 2016 : 45 - 48 .

ANT GROUP . Confidential computing cloud servic [EB ] .

ANT GROUP . Intel software guard extensions developer guide [EB ] .

DHIMAN C , ATUL A J , SVEN B . Poster:TGX:secure SGX enclave management using TPM [C ] // Proc.of the 2017 Network and Distributed System Security Symp (NDSS 2019) . 2019 .

严飞 , 于钊 , 张立强 , 等 . vTSE:一种基于 SGX 的 vTPM 安全增强方案 [J ] . 工程科学与技术 , 2017 ( 2 ).

YAN F , YU Z , ZHANG L Q , et al . vTSE:a safety enhancement scheme of vTPM based on SGX [J ] . Engineering Science and Technology , 2017 ( 2 ).

百度安全 . MesaTEE安全计算平台 [EB ] .

Baidu security . Mesatee security computing platform [EB ] .

VISHAL K , ERICK B , LIN Z Q , et al . 2017.SGX-Log:securing system logs with SGX [C ] // Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security (ASIA CCS '17.Association for Computing Machinery . 2017 : 19 - 30 .

SINISA M , KARL W , MORITZ S , et al . BITE:bitcoin lightweight client privacy using trusted execution [C ] // Proceedings of the 28th USENIX Conference on Security Symposium (SEC'19) . 2019 : 783 - 800 .

PRIEBE C , VASWANI K , COSTA M . EnclaveDB:a secure database using SGX [C ] // 2018 IEEE Symposium on Security and Privacy (SP) . 2018 .

BZUMAN E , LIN Z Q . 2016.A case for protecting computer games with SGX [C ] // Proceedings of the 1st Workshop on System Software for Trusted Execution (SysTEX '16).Association for Computing Machinery . 2016 : 1 - 6 .

GOLTZSCHE D , WULF C , MUTHUKUMARAN D , et al . TrustJS:trusted client-side execution of Javascript [C ] // The 10th European Workshop . 2017 .

冯达 , 王强 , 赵译文 , 等 . 基于SGX的证书可信性验证与软件安全签发系统 [J ] . 信息网络安全 , 2018 ( 3 ): 63 - 69 .

FENG D , WANG Q , ZHAO Y W , et al . Certificate credibility verification and software security issuing system based on SGX [J ] . Information Network Security , 2018 ( 3 ): 63 - 69 .

OLGA O , FELIX S , CEDRIC F , et al . 2016.Oblivious multi-party machine learning on trusted processors [C ] // Proceedings of the 25th USENIX Conference on Security Symposium(SEC'16) . 2016 : 619 - 636 .

WANG H B , ERICK B , VIISHAL K , et al . 2019.Running language interpreters inside SGX:a lightweight,legacy-compatible script code hardening approach [C ] // Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security (Asia CCS '19).Association for Computing Machinery . 2019 : 114 - 121 .

王鹃 , 樊成阳 , 程越强 , 等 . SGX 技术的分析和研究 [J ] . 软件学报 , 2018 , 9 ( 9 ): 2778 - 2798 .

WANG J , FAN C Y , CENG Y Q , et al . Analysis and research of SGX technology [J ] . Journal of Software , 2018 , 9 ( 9 ): 2778 - 2798 .

WEISSE O , BERTACCO V , AUSTIN T . Regaining lost cycles with hotcalls:a fast interface for SGX secure enclaves [C ] // The 44th Annual International Symposium . 2017 .

TIAN H , ZHANG Y , XING C , et al . SGX Kernel:a library operating system optimized for intel SGX [C ] // The Computing Frontiers Conference . 2017 .

SARTAKOV V A , BRENNER S , MOKHTAR S B , et al . EActors:fast and flexible trusted computing using SGX [C ] // The 19th International Middleware Conference . 2018 .

XING B C , SHANAHAN M , LESLIE H R . Intel software guard Extensions (Intel SGX) software support for dynamic memory allocation inside an enclave [C ] // Proc of the Hardware and Architectural Support for Security and Privacy 2016 (HASP 2016) . 2016 . 1 - 9 .

ORENBACH M , LIFSHITS P , MINKIN M , et al . Eleos:ExitLess OS services for SGX enclaves [C ] // Proc of the 12th European Conf on Computer Systems . 2017 . 238 - 253 .

MORITZ L , MICHAEL S , DANIEL G , et al . Meltdown:reading kernel memory from user space [C ] // USENIX Security Symposium . 2018 .

KOCHER P , GENKIN D , GRUSS D , et al . Spectre Attacks:Exploiting speculative execution [J ] . Communications of the ACM , 2018 , 63 ( 7 ).

JO V B , MARINA M , OFIR W , et al . Foreshadow:extracting the keys to the Intel SGX kingdom with transient out-of-order execution [C ] // USENIX Security Symposium . 2018 .

SCHAIK S V , MILBURN A , STERLUND S , et al . RIDL:rogue in-flight data load [C ] // Symposium on Security ＆ Privacy . 2019 .

OLEKSII O , BOHDAN T , ROBERT K , et al . Varys:protecting SGX enclaves from practical side-channel attacks [C ] // Proceedings of the 2018 USENIX Conference on Usenix Annual Technical Conference (USENIX ATC '18) . 2018 : 227 - 239 .

MURDOCK K , OSWALD D , GARCIA F D , et al . Plundervolt:software-based fault injection attacks against intel SGX [C ] // 2020 IEEE Symposium on Security and Privacy(SP) . 2020 .

MUSTAKIMUR R K , CHENG Y Q , WANG Z , et al . 2020.Coin attacks:on insecurity of enclave untrusted interfaces in SGX [C ] // Proceedings of the 25 International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS '20).Association for Computing Machinery . 2020 : 971 - 985 .

BAUMAN E , WANG H B , ZHANG M W , et al . 2018.SGXElide:enabling enclave code secrecy via self-modification [C ] // Proceedings of the 2018 International Symposium on Code Generation and Optimization (CGO 2018) . Association for Computing Machinery , 2018 : 75 - 86 .

JAIN P , DESAI S , KIM S , et al . OpenSGX:an open platform for SGX research [C ] // NDSS . 2016 .

CHOI C , KWAK N , JANG J , et al . S-OpenSGX:a system-level platform for exploring SGX enclave-based computing [J ] . Computers ＆ Security , 2017 , 70 ( sep. ): 290 - 306 .

DING Y , DUAN R , LI L , et al . POSTER:Rust SGX SDK:towards memory safety in Intel SGX enclave [C ] // Proc of the 2017 ACM SIGSAC Conf.on Computer and Communications Security (CCS 2017) . 2017 . 2491 - 2493 .

MesaPy [EB ] .

GHOSN A , LARUS J R , BUGNION E . Secured routines:language-based construction of trusted execution environments [C ] // 2019 USENIX Annual Technical Conf (ATC 2019) . 2019 : 571 - 586 .

SHINDE S , TIEN D L , TOPLE S , et al . Panoply:low-TCB Linux applications with SGX enclaves [C ] // Network ＆ Distributed System Security Symposium . 2017 .

TSAI C C , PORTER D E , VIJ M . Graphene-SGX:a practical library OS for unmodified applications on SGX [C ] // Proc of 2017 USENIX Annual Technical Conf (ATC 2017) . 2017 : 645 - 658 .

Occlum [EB ] .

VICTOR C , SRINIVAS D . Intel SGX Explained [C ] // IACR Cryptology ePrint Archive 2016 . 2016 :86.

刘国杰 , 张建标 . 基于 TPCM 的服务器可信 PXE 启动方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 6 ): 105 - 111 .

LIU G J , ZHANG J B . TPCM-based trusted PXE boot method for servers [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 6 ): 105 - 111 .

RICH U , GIL N , DION R , et al . Intel virtualization technology [J ] . Computer , 2005 , 38 ( 5 ): 48 - 56 .

董攀 , 丁滟 , 江哲 , 等 . 基于TEE的主动可信TPM/TCM设计与实现 [J ] . 软件学报 , 2020 , 31 ( 5 ): 1392 - 1405 .

DONG P , DING Y , JIANG Z , et al . Active and credible TPM/TCM design and implementation based on TEE [J ] . Journal of Software , 2020 , 31 ( 5 ): 1392 - 1405 .

章张锴 , 李舟军 , 夏春和 , 等 . 借助 Hypervisor 强化 TrustZone对非安全世界的监控能力 [J ] . 软件学报 , 2018 ( 8 ): 2511 - 2526 .

ZHANG Z K , LI Z J , XIA C H , et al . Strengthening the monitoring capability of TrustZone to non-secure world with the help of Hypervisor [J ] . Journal of Software , 2018 ( 8 ): 2511 - 2526 .

WU Y , LIU Y , LIU R , et al . Comprehensive VM protection against untrusted hypervisor through retrofitted AMD memory encryption [C ] // IEEE International Symposium on High Performance Computer Architecture , I2018 .

Views

1183

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on the trusted environment of container cloud based on the TPCM

TPCM-based trusted PXE boot method for servers

Trusted platform for third-party cloud computing online evaluation and analysis technology

Trusted access scheme for intranet mobile terminal based on encrypted SD card

Research on key management and authentication protocol of PDA in smart grid

Related Author

Zheng LI

Ping YANG

Jianbiao ZHANG

Guojie LIU

Jianbiao ZHANG

Guojie LIU

Fei YAN

Bo ZHAO

Related Institution

Beijing Information Science and Technology University

Beijing Key Laboratory of Trusted Computing

Faculty of Information Technology, Beijing University of Technology

Cyberspace Security Research Center,Peng Cheng Laboratory

Cyberspace Security Research Center of Hubei Province

⁰