Scalable Memory Protection in the PENGLAI Enclave
Talkat 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI '21) · 2021-07-14..07-16·
summary
Prototype Penglai adds two hardware primitives, Guarded Page Table (GPT) and Mountable Merkle Tree (MMT) plus a shadow fork fast-init, enabling page-grained secure memory, scalable integrity, and fork-style enclave creation. Implemented on RISC‑V Penglai and evaluated on FPGA, it supports thousands of concurrent enclaves and up to 512 GB of encrypted+integrity-protected secure RAM; GPT adds ~5% overhead on memory-heavy workloads (negligible on CPU-bound), initialization latency falls by three orders of magnitude, and real MapReduce workloads see up to 3.6× speedup.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:24Enclave / TEE (Trusted Execution Environment)
- 1:01Existing Enclaves and Usages in Cloud
- 2:07Restrictions of Current Enclaves
- 3:00Non-scalable Secure Memory Protection
- 3:51Scalable Memory Protection: Overview
- 4:28Non-scalable Memory Isolation
- 5:08Fine-grained Flexible Memory Isolation
- 5:50Guarded Page Table (GPT)
- 6:54Non-scalable Integrity Protection
- 7:40Scale the Traditional Merkle Tree
- 8:23Mountable Merkle Tree (MMT)
- 10:10Non-scalable Memory Initialization
- 10:36Boost Secure Memory Initialization
- 11:24Evaluation
- 13:09Enclave Startup Latency
- 13:45Conclusion
related talks
18mGuest Memory Protection -- Current Status and Future
20mEnabling Low-Cost Secure Computing on Untrusted In-Memory Architectures
19mEPK: Scalable and Efficient Memory Protection Keys
35mZephyr OS Memory Protection
41mProtected Execution Facility
25mTelling Your Secrets without Page Faults...
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves- 35mZephyr OS Memory Protection