# Enhancing the Privacy of Network Services through Trusted Computing
## 3 A Trusted and Backward-Compatible Addressing Service
### Backward-Compatible Service  
As shown in Figure 1, DoTT is separated into two parts: the untrusted system runs in normal environments, and the trusted part runs in an enclave. To ensure the minimum attack surface, SGX limits the code that can be run in an enclave. In the SDK provided by SGX, only basic operation functions are included, while file I/O and network communication functions are forcibly separated into untrusted codes. Hence, the existing codes must be refactored to run in SGX. The code separation in the development model of SGX brings challenges to the transplantation of existing software [41]. First, it takes a lot of time to divide the code into trusted and untrusted parts. Second, there is no guarantee that the reconstructed code is completely compatible with the original. The code refactoring risks damaging the existing system. To avoid the problem of rewriting all DNS codes, we propose a new compiling model, as shown in Figure 2. We first replace the part of the existing code that needs to be run in SGX with a scaffold function. This tool will selectively execute the SGX and normal functions with the same logic according to the runtime environment. For example, the original file reading function \(\text{read}(\text{args}\ldots)\) can be replaced by common_ecall (read, ret, \(\text{sgx\_read}\), \(\text{fread}\), \(\text{args}\ldots)\). common_call will be extended to a branch function during the compilation process. It will first check whether the current host has the SGX feature at the runtime. If it is supported, the function \(\text{sgx\_fread}\) of the SGX version will be called, and the original freed function will be called in turn. The parameters (args) can be transferred from the normal environment to the enclave by using the \(\text{sgx\_edger}\), a compilation tool provided by Intel SGX SDK through stub functions. In addition to the code, we need to refactor the linking process. The SGX technology limits the use of standard libc functions and only provides a small number of system abstractions for developers due to security considerations and design limitations. In addition to simple macro replacement (common_ecall), we also need to move the code to be run in an SGX enclave to a common file. During the linking process, this common code will be compiled into a static (.a) file first and then linked with SGX runtime libraries into a signed resolver.signed.so file. At the same time, we will compile and generate a normal resolver.so file. This compilation and linking process are all performed automatically. We chose Bazel [42], a scalable and extensible build system, to define a new library rule named enclave_library in the implementation. The prototype is enclave_library (name, edl, trusted_hdr, trusted_src, untrusted_src, hdrs, untrusted_deps) where name indicates the generated library name, edl indicates the original SGX interface description file, trusted_hdr and trusted_src, respectively, indicate the header file and source codes to be compiled into trusted.so file, and untrusted_src and untrusted_deps indicate the untrusted source codes dependent files. Notes that untrusted code can call the code in the trusted file, while trusted code cannot call untrusted code conversely. The compilation model we propose will generate two sets of codes and runtime libraries for an application. In a non-SGX environment, untrusted code plus trusted code is the same as the code logic in the original DNS resolver. To make the non-SGX runtime of DoTT compatible with the authentication process, when the DNS stub launches a challenge, the non-SGX DoTT will return an empty Quote, and then the stub will ignore the report verification and continue the TLS establishment process. This change does not affect the security assumptions in the DoTT. Through this new compilation model, we only need to make small changes to the original code and move part of the code to a new file.