An Optimization Methodology for Adapting Legacy SGX Applications to Use Switchless Calls

Seongmin Kim

doi:10.3390/app11188379

Abstract

A recent innovation in the trusted execution environment (TEE) technologies enables the delegation of privacy-preserving computation to the cloud system. In particular, Intel SGX, an extension of x86 instruction set architecture (ISA), accelerates this trend by offering hardware-protected isolation with near-native performance. However, SGX inherently suffers from performance degradation depending on the workload characteristics due to the hardware restriction and design decisions that primarily concern the security guarantee. The system-level optimizations on SGX runtime and kernel module have been proposed to resolve this, but they cannot effectively reflect application-specific characteristics that largely impact the performance of legacy SGX applications. This work presents an optimization strategy to achieve application-level optimization by utilizing asynchronous switchless calls to reduce enclave transition, one of the dominant overheads of using SGX. Based on the systematic analysis, our methodology examines the performance benefit for each enclave transition wrapper and selectively applies switchless calls without modifying the legacy codebases. The evaluation shows that our optimization strategy successfully improves the end-to-end performance of our showcasing application, an SGX-enabled network middlebox.

Highlights

Cloud computing allows enterprises to migrate their services from traditional physical servers to the virtualized environments
To validate our optimization on our target application, we evaluate the performance of software guard extension (SGX)-enabled network middleboxes with micro-benchmarks and end-to-end performance analysis
This paper proposes an application-level optimization methodology by adaptively leveraging switchless calls to reduce SGX overhead

Summary

Introduction

Cloud computing allows enterprises to migrate their services from traditional physical servers to the virtualized environments. TEE ensures the integrity and confidentiality of the encrypted memory region and provides a trusted computing base (TCB) to launch a secure execution environment from the untrusted part of the system. These advantages overcome the limitations of previous trusted platform modules (TPMs), suffering from limited functionality that only supports cryptographic operations [6]. Service providers who run their applications in the cloud platform cannot access or control hardware components and the underlying privileged software components They cannot even be unaware of whether data leakage incidents [30] from the cloud happens unless a cloud platform provider notifies the leakage

Objectives

Methods

Results

Discussion

Conclusion