An Extensible Orchestration and Protection Framework for Confidential Cloud Computing
summary
eOPF is a hypervisor-level instrumentation framework that traps enclave events by making enclave pages non-executable, intercepting interrupts and using a single-step debug trap, and attests co-location with a machine certificate plus a user-watermark inserted into enclave memory. It implements secure orchestration (runtime monitoring, malware-signature scanning, creation control) and side-channel defense (resource partitioning and clearing). Evaluation shows <2% overhead by default and a geometric-mean overhead of 17% on SPEC when defenses are enabled.
AI-written summary · about
chapters (11)
- 0:00Confidential cloud computing intro
- 1:10Intel SGX limitations
- 2:56Hardware updates not viable
- 4:21Narrowing SGX threat model
- 6:08EUPF framework design
- 8:36Trapping enclave events
- 9:39Verifying enclave co-location
- 11:07Secure orchestration service
- 11:50Side channel defense
- 13:33Performance evaluation
- 13:55Key takeaways
related talks
41mProtected Execution Facility
25mProtecting Modern Workloads with eBPF superpowers
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
20mEPF: Evil Packet Filter
41mTaking Command of Cloud Security with OPA
38mOPA for the cloud natives
15mOsprey: Transparent and Efficient Virtual Memory for Secure Computation
41mOP-TEE - Using TrustZone to Protect Our Own Secrets