# Design and Implementation of Virtual Security Function Based on Multiple Enclaves
## 4 System Design
### Hot Swapping  
Click provides support for hot swapping [10]. Hot swapping means that when the system processes packets according to its configuration, the user can dynamically modify the configuration (such as adding new elements, etc.) without stopping the system. If the new configuration is resolved correctly, the new configuration will automatically take over the states of the old configuration and continue processing the packet, for example, any queued packets will be moved to the new configuration. In this way, Click can implement the function of dynamically modifying the configuration without terminating the operation. Hot swapping can modify (add or delete) elements in the configuration file by creating new routes, hence you need to establish communication through the \"ControlSocket element (an element opens control sockets for other programs)\" and pass the modified configuration information for Click resolution. When we use SGX to guarantee the run-time security of the elements, it will inevitably cause losing the dynamic configuration modification function of Click. In this paper, we propose a new hot swapping mechanism based on SGX and Click technology to keep the system to dynamically configure without termination. Figure 5 is a flow chart of the system hot swapping. When a user needs to use the hot swap function to dynamically modify the configuration, they first add a parameter, such as -r, and add the ControlSocket element to the configuration file (declare the connection, type and port number). When the system starts running, it first reads the command line parameters. According to whether the command line has the -r parameter, it is determined whether the configuration needs to support the hot swap function. If there is a -r parameter, the system will add a global write Handler in the Manger main (global write Handler including element name, Handler name, user data, etc.). After the Handler is added, the Handler is stored as a global Handler to dynamically modify the configuration file through the Handler. The system then begins routing initialization. After the route initialization is complete, the old configuration begins to run normally. At this point, on the one hand, the system routes the packet through the old configuration. On the other hand, the ControlSocket in the old configuration is always listening for the connection. When the user needs to use the hot swap function to modify the running old configuration file, a new terminal is connected to the port of the old configuration that is running through the ControlSocket, and the new configuration is sent to the old system through the ControlSocket connection. When the old system listens to the new connection, it first parses the new command, matches the parsed Handler with the stored Handler according to the Handler name, and if the matching is successful, it creates a new lexer and route, parses the new configuration, and connect the elements and ports. In addition, the enclave as a Click element is created, configured, and initialized in order based on the contents of the new configuration file. After all the enclaves in the new configuration are initialized, the system will destroy the last route used for hot-plugging and copy the newly created route to the hot-plug route. If the new configuration does not require enclave creation, it just performs this step directly. Next, the system will set the running state of the newly created route for subsequent scheduling by the state information. Finally, the system driver starts the execution of the schedule. It first suspends the old configuration that  
Figure 4: Secure Boot. is running, and then compare the enclaves in the old and new configuration one by one. If there is the same enclave, the state information of the enclave in the old configuration is synchronized by the state synchronization function through a secure channel established by local attestation.