Automatic Inference of Enclave Placement in LLVM Compiler
summary
Claims a practical LLVM-based pipeline that infers which functions and pointers must live inside enclaves and lowers them to Intel SGX using OpenEnclave, encoding LLVM IR with security labels as metadata, solving placement as constraints fed to Z3 SMT optimization, and emitting OpenEnclave→Intel SGX code. It handles implicit flows by CFG analysis and per-block PC labels, models pointer modes for enclave/mode constraints, currently runs basic examples (Hello World), and assumes passive attackers; formal theorems are work in progress.
AI-written summary · about
chapters (9)
- 0:00Enclave placement in LLVM
- 2:46Trusted execution environments
- 5:17Manual enclave partitioning
- 7:45Formalizing enclave inference
- 10:12Security guarantees
- 14:10Constraint optimization
- 16:59LLVM and Z3 implementation
- 17:21Conclusion and future work
- 17:41Q&A
related talks
31mInferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing
23mSecuring Interruptible Enclaves
16mReconciling Optimization With Secure Compilation
21mTowards Compiler-Guided Static Analysis
25mTelling Your Secrets without Page Faults...
53mLLVM
19mRethinking Isolation Mechanisms for Datacenter Multitenancy
23mRISC V Enclaves A Clean Slate Approach To Linux Security