In this post, we are discussing paper “SCONE: Secure Linux Container Environment with Intel SGX” from OSDI’16 by Sergei Arnautov et al..

The motivation of this work is that nowadays, computation/data outsourcing is getting more and more popular, and normally users have to trust the cloud provider that the server won’t maliciously steal the information or affect the integrity of the execution. Besides, users must believe that the infrastructure(software/hardware) is secure enough to defend against every attacks launched by the adversary co-locate with the user program.

With all of the above in mind, this work assumes a powerful privileged adversary who controls the entire software stacks, and utilizes Intel SGX as the hardware TCB to protect the attack from the software level. Intel SGX provides a isolated environment for program’s execution called enclave, with the cost of performance loss.

The goal of this paper is to provide: 1) security: use Intel SGX to create a secure linux container, thus programs running inside the container have confidentiality and integrity under protection 2） performance: reduce the performance overhead caused by system calls 3) usability: make the container easy to deploy

This work, SCONE, achieves all these objectives. For security, SCONE provides customized C library and interface shielding to ensure the confidentiality and integrity of the application data passed through the OS to the hardware. The performance is achieved by the observation that for most workloads, the degredation is caused by process transition at system calls, therefore one can create another threads for executing the system calls, and schedule another thread to execute while the current thread is waiting for the system call to finish. SCONE is also integrated into Docker.

A link to the presentation slides can be found here