Secure Container with SGX: Protecting Secret in Cloud Environment
summary
Claims that unmodified Go binaries run inside SGX by extending Graphene and that this avoids costly source rewrites. Implements Graphene-SGX LibOS, static binary patching to replace illegal SGX syscalls instead of expensive trap-and-emulate, a dedicated enclave stack to avoid overflows, and filesystem hashing for integrity. Prototype runs Go hello-world and larger workloads; CPU-bound code shows near-native speed while syscall‑heavy paths suffer higher latency. Plans target 1.0 and ongoing stability fixes. Graphene-SGX LibOS user binary runs unmodified
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:43Cloud security challenges
- 3:17TEE with Intel SGX
- 5:26SGX app adaptation costs
- 7:17Library OS for unmodified binaries
- 9:46Library OS benefits
- 13:28Go support challenges
- 15:18Graphene library OS
- 18:58Optimizing Graphene for Go
- 20:53Live demo: Go in Graphene
- 22:43Summary and future
- 24:12Q&A: Unmodified Go binaries
- 25:40Q&A: System calls in Go
- 26:44Q&A: Performance vs native
- 27:49Q&A: Iago attacks defense
- 30:26Q&A: Container protection
- 31:15Q&A: SGX memory keys
related talks
32mSecure Container with SGX: Protecting Secret in Cloud Environment
46mAutomatically Securing Linux Application Containers in Untrusted Clouds
15mSecured Routines: Language-based Construction of Trusted Execution Environments
39mConfidential computing with Go
35mBringing Intel SGX to the Rust Ecosystem
46mState of Intel SGX in Linux
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure