Occlum: Secure and Efficient Multitasking Inside a Single Enclave of Intel SGX. Intel Software Guard Extensions (SGX) enables userlevel code to create private memory regions called enclaves, whose code and data are protected by the CPU from software and hardware attacks outside the enclaves. Recent work introduces library operating systems (LibOSes) to SGX so that legacy applications can run inside enclaves with few or even no modifications. As virtually any nontrivial application demands multiple processes, it is essential for LibOSes to support multitasking. However, none of the existing SGX LibOSes support multitasking both securely and efficiently.  :84,paper presents Occlum, a system that enables secure and efficient multitasking on SGX. We implement the LibOS processes as SFIIsolated Processes (SIPs). SFI is a software instrumentation technique for sandboxing untrusted modules (called domains). We design a novel SFI scheme named MPXbased, MultiDomain SFI (MMDSFI) and leverage MMDSFI to enforce the isolation of SIPs. We also design an independent verifier to ensure the security guarantees of MMDSFI. With SIPs safely sharing the single address space of an enclave, the LibOS can implement multitasking efficiently. The Occlum LibOS outperforms the stateoftheart SGX LibOS on multitaskingheavy workloads by up to 6,600X on microbenchmarks and up to 500X on application benchmarks.

Squad: A Secure, Simple Storage Service for SGXBased Microservices Intel SGX has been the subject of numerous research and development projects. Moreover, this technology has been considered a robust option to secure the data being processed in cloud environments. Despite this, configuring SGXbased applications in complex and dynamic scenarios such as microservice architectures is still a challenge. The process of configuring such applications must guarantee the trustworthiness of the services, and must be simple and efficient. We then propose a solution for configuring and provisioning secrets to SGXbased applications made with help from the Intel SGX SDK. We present a simple solution that can be easily validated and hardened. Also, the solution is pluggable and can be extended to fit specific requirements or leverage other tools (e.g., for data persistence). In addition to describing our proposal, we also provide an evaluation that shows low overhead to the initialization and configuration time of SGX microservices deployed on Kubernetes. This work contributes to the stateoftheart of the usage of trusted execution environments in cloud computing.