SafeBricks: Shielding Network Functions in the Cloud
summary
SafeBricks claims to run real network functions in cloud enclaves so both headers and payloads stay encrypted outside the enclave and NF code/rules remain confidential. It combines Intel SGX enclaves, a Click-like NetBricks pipeline, and a Rust-based controller enforcing a Rust ownership model that lends field references per-packet to enforce least privilege. It bootstraps IPSec from a gateway, eliminates enclave exits by decoupling host and enclave threads, and measures 0–15% overhead until the working set exceeds 94 MB enclave memory limit.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 2:58SafeBricks foundations
- 5:13Protecting traffic
- 6:50Designing the architecture
- 11:37Least privilege enforcement
- 14:54Confidentiality and assembly
- 17:00Evaluation and conclusion
- 18:40Question and answer session
related talks
40mConfidential Computing Across Multiple Clouds and Platforms: Project Enarx
38mOne Ring -3 To Secure Them All: Computing with Hardware Enclaves
36mAttacking & Defending Kubernetes TEE Enclaves in Critical Infrastructure
48mBetrusted: Better Security Through Physical Partitioning
53mEnarx - secured, attested execution on any cloud
35mDon't Trust, Attest: Enclaves as a Trust-Minimization Tool for Bitcoin Apps
28mSanctum: Minimal Hardware Extensions for Strong Software Isolation
46mAutomatically Securing Linux Application Containers in Untrusted Clouds