A Comparison Study of the Compatibility Approaches for SGX Enclaves

Confidential computing technologies, such as that enabled by Intel SGX (Software Guard eXtensions), have been widely deployed in various commercial cloud platforms. Specifically, SGX uses hardware-isolated compartments named enclaves to shield user applications from Operating Systems (OSes) and hypervisors, thus providing confidentiality and integrity guarantees for code and data. However, some crucial problems are not fully analyzed yet, especially for the compatibility with binary applications. This work first delivers an overview of Intel SGX and reviews its five design constraints that may affect compatibility. Subsequently, we revisit three distinct compatibility solutions from the internals and analyze their impact on security, performance, and flexibility. At last, we lay out some fundamental lessons learned from prior SGX studies.