# Design and Implementation of Virtual Security Function Based on Multiple Enclaves
## 4 System Design  
### System Structure  
Our goal is to design and implement a multi-enclave-based virtual security function architecture based on SGX and Click technology. Click itself can build complex network functions through many small elements with packet processing capabilities, and Click supports developers to design new elements according to their own requirements. In order to ensure the security of VNF, we use SGX technology to protect the VNF in the enclave. However, if we completely adopt the Click architecture, and put each element in a separate enclave, there will be too many enclaves, which has large EPC memory and communication costs, although it can retain its modular advantages. According to our testing, packet transmission across enclaves can result in significant performance overhead. When the number of enclaves is too large, the frequency of packets entering and leaving the enclave is too large, which causes a lot of overhead. Therefore, this paper proposes to split the overall VNF into multiple small modules according to the packet type and put them into a single enclave to protect them. Each module is responsible for one feature of packet processing, and these modules can be freely combined based on user requirements. At this point, the frequency of data packets entering and leaving the enclave is much smaller than that of the small element combination, which not only ensures the runtime security of the VNF but also retains the modular advantage of Click to some extent.  
Figure 3 shows the overall architecture of a virtual security function based on multiple enclaves. The architecture consists of a whole VNF composed of multiple enclaves, local attestation module, manager module, Log module, system call lib, socket, DPDK, and NICs.  
Figure 3: System Architecture.  
Due to the limitations of SGX technology [22], it is impractical to protect all the data in SGX and we need to classify the data. The architecture is mainly divided into trusted parts, untrusted parts, and NICs. Among them, the conversion between the trusted part and the untrusted part needs to perform data interaction through the encapsulated cell and ocall of SGX. Ecall and ocall are key factors in the performance of SGX. When the number of enclaves is too many, the frequent entry and exit of enclaves will cause a lot of extra overhead. Therefore, we need to control the number of enclaves to ensure high performance. Ecall is the function call performed by the untrusted part to enter an enclave, passing some arguments and/or expecting a return value. In addition, ocall is the function call performed by the enclave to call back to the untrusted part, passing some arguments and/or expecting a return value.  
The manager is a key part of the system and responsible for the secure boot of the system, mainly including the command line parameters parsing, the enclave configuration and initialization, the overall operation of the control system, and a management of the enclave life cycle. The Manager has both trusted and untrusted parts, including the Configure file stored in the trusted part and the hot swapping in the untrusted part to support hot swapping. The NICs represent network interface controllers, which are responsible for receiving data frames sent by other devices on the network and reassembling the frames into packets.