English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Trusted executions environments (TEEs) such as Intel(R) SGX providehardware-isolated execution areas in memory, called enclaves. By running onlythe most trusted application components in the enclave, TEEs enable developersto minimize the TCB of their applications thereby helping to protect sensitiveapplication data. However, porting existing applications to TEEs often requiresconsiderable refactoring efforts, as TEEs provide a restricted interface tostandard OS features. To ease development efforts, TEE application developersoften choose to run their unmodified application in a library OS container thatprovides a full in-enclave OS interface. Yet, this large-TCB developmentapproach now leaves sensitive in-enclave data exposed to potential bugs orvulnerabilities in third-party code imported into the application. Importantly,because the TEE libOS and the application run in the same enclave addressspace, even the libOS management data structures (e.g. file descriptor table)may be vulnerable to attack, where in traditional OSes these data structuresmay be protected via privilege isolation.  We present EnclaveDom, a privilege separation system for large-TCB TEEapplications that partitions an enclave into tagged memory regions, andenforces per-region access rules at the granularity of individual in-enclavefunctions. EnclaveDom is implemented on Intel SGX using Memory Protection Keys(MPK) for memory tagging. To evaluate the security and performance impact ofEnclaveDom, we integrated EnclaveDom with the Graphene-SGX library OS. While noproduct or component can be absolutely secure, our prototype helps protectinternal libOS management data structures against tampering byapplication-level code. At every libOS system call, EnclaveDom then only grantsaccess to those internal data structures which the syscall needs to perform itstask.

EnclaveDom: Privilege Separation for Large-TCB Applications in Trusted Execution Environments