Secure Container with SGX: Protecting Secret in Cloud Environment
summary
Claims that unmodified Go binaries can run inside Intel SGX by extending Graphene LibOS into Graphene-SGX, using patching Go runtime to replace forbidden syscall instructions and a stack/emulation optimization (dedicated tiny stacks + accurate signal emulation). Demonstrated attestation and a Hello World run; CPU-bound code shows near-native speed while syscall- or I/O-heavy workloads slow significantly. Implements file-hash checks and minimizes host-kernel reliance to mitigate Iago-style attacks. Work is functional today with a planned 1.0 release and ongoing bug fixes.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:40Memory bus
- 5:21Adaptation
- 6:17Mitigation
- 6:49Low Cost
- 7:35Library OS
- 9:47Interlibrary OS
- 15:09graphene OS
- 16:47disguise
- 18:04current state
- 19:56demo
- 22:36summary
- 23:18please contribute
- 24:00QA
related talks
32mSecure Container with SGX: Protecting Secret in Cloud Environment
46mAutomatically Securing Linux Application Containers in Untrusted Clouds
15mSecured Routines: Language-based Construction of Trusted Execution Environments
39mConfidential computing with Go
35mBringing Intel SGX to the Rust Ecosystem
46mState of Intel SGX in Linux
18mYou Can Sign It, But Can You Trust It? Securing the Compilation Process
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive...