论文标题
Hyperenclave：一个开放和跨平台的可信执行环境
HyperEnclave: An Open and Cross-platform Trusted Execution Environment
论文作者
论文摘要
学术界和行业都提出了许多值得信赖的执行环境（TEE）。但是，其中大多数都需要特定的硬件或固件更改，并绑定到特定的硬件供应商（例如Intel，AMD，ARM和IBM）。在本文中，我们提出了Hyperenclave，这是一个基于开放且跨平台的过程的TEE，它依赖于广泛可用的虚拟化扩展来创建孤立的执行环境。特别是，Hyperenclave旨在支持灵活的飞地操作模式，以满足各种飞地工作负载下的安全性和绩效要求。我们提供飞地SDK以很少或没有源代码更改在Hyperenclave上运行现有的SGX程序。我们已经在商品AMD服务器上实施了Hyperenclave，并将系统部署到了世界领先的金融科技公司中，以支持现实世界中的隐私计算。对微基准和应用程序基准的评估表明，Hyperenclave的设计仅引入了一个小开销。
A number of trusted execution environments (TEEs) have been proposed by both academia and industry. However, most of them require specific hardware or firmware changes and are bound to specific hardware vendors (such as Intel, AMD, ARM, and IBM). In this paper, we propose HyperEnclave, an open and cross-platform process-based TEE that relies on the widely-available virtualization extension to create the isolated execution environment. In particular, HyperEnclave is designed to support the flexible enclave operation modes to fulfill the security and performance demands under various enclave workloads. We provide the enclave SDK to run existing SGX programs on HyperEnclave with little or no source code changes. We have implemented HyperEnclave on commodity AMD servers and deployed the system in a world-leading FinTech company to support real-world privacy-preserving computations. The evaluation on both micro-benchmarks and application benchmarks shows the design of HyperEnclave introduces only a small overhead.
