Slide 1: Introduction to Intel Software Guard Extensions (Intel SGX)
Introduction to Intel’ Software Guard Extensions (Intel’ SGX) April 18, 2017
Slide 2: Why Use Intel SGX?
Why Use Intel® SGX? Many applications have secrets that need to be protected. Examples of secrets include: Healthcare records Personally identifiable Biometric factors information (PII) and templates Passwords Encryption keys Intellectual property (IP) 2
Slide 3: What Is Intel SGX?
What Is Intel® SGX? A Trusted Execution Environment from Intel for applications Trusted hardware: the CPU die Isolates a portion of physical memory to protect select code and data from view or modification In Intel SGX, these isolated portions of memory are called “enclaves” 3
Slide 4: Trusted and Untrusted Partitions
Trusted and Untrusted Partitions Untrusted Part of App Trusted Part of App 1. An Intel® SGX–enabled (Enclave) app is built with trusted and untrusted parts. /** A PNG Image file. */ Class ImageFile { 2. Best practice: the trusted Public: ImageFile(); partition should contain just ~ImageFile(); the m
Slide 5: What Intel SGX Can't Protect You From
What Intel® SGX Can’t Protect You From Buffer-overflow attacks Side-channel attacks Untrusted inputs into the enclave There is no substitute for good, secure programming practices 5
Slide 6: Intel SGX Design Imperatives
Intel® SGX Design Imperatives Protect sensitive data Do not interfere with legitimate operations Develop trusted applications using familiar tools and processes 6
Slide 7: What Do You Need to Develop and Run Enclaves?
What Do You Need to Develop and Run Enclaves? A platform with an Intel® SGX–enabled CPU and BIOS Intel SGX platform software (PSW) The Intel SGX software- development kit (SDK) Microsoft Visual Studio 2015 Professional* or Eclipse™ – Supports Intel SGX debugger 7
Slide 8: What Can You Do with Enclaves?
What Can You Do with Enclaves? 1 2 3 Access secrets Attest services Seal secrets 8
Slide 9: Demonstration: Creating a "SGX First App"
Creating a “SGX First App” Intel® SGX Application Demons tration
Slide 10: Create a Console-Application Project
Demo Create a Console-Application Project 10
Slide 11: Create a Console-Application Project
Demo Create a Console-Application Project 11
Slide 12: Create a Console-Application Project
Demo Create a Console-Application Project 12
Slide 13: Create an Enclave-Application Project
Demo Create an Enclave-Application Project 13
Slide 14: Add an Enclave Project to the Console-Application Project
Demo Add an Enclave Project to the Console-Application Project 14
Slide 15: Import an Enclave into a Console Application
Demo Import an Enclave into a Console Application 15
Slide 16: Import an Enclave into a Console Application
Demo Import an Enclave into a Console Application 16
Slide 17: Import an Enclave into a Console Application
Demo Import an Enclave into a Console Application 17
Slide 18: Import an Enclave into a Console Application
Demo Import an Enclave into a Console Application 18
Slide 19: Technical Discussion: EDL
Technical Discussion: EDL
Slide 20: A Brief Introduction to EDL
A Brief Introduction to EDL EDL stands for Enclave Definition Language. It defines the interface between the trusted and untrusted portions of your applications. 20
Slide 21: Trusted and Untrusted Application Code
Trusted and Untrusted Application Code Untrusted Part of App Trusted Part of App 1. An Intel® SGX–enabled app is built (Enclave) with trusted and untrusted parts. Call 2. The app runs and creates an enclave, Gate Execute which is placed in trusted memory. Create Enclave 3. A trusted function is call
Slide 22: Edge Code Auto-generation
Edge Code Auto-generation The Intel® SGX SDK auto-generates edge routines defined by EDL through use of the Edger8r* tool: Intel SGX uses only plain C, so wrapper functions are necessary. It auto-generates the code the first time you build a project. It produces edge routines for accessing enc
Slide 23: Demonstration: Completing the "SGX First App"
Completing the “SGX First App” Enclave Application Demons tration
Slide 24: Add a Trusted Call to an Enclave Project
Demo Add a Trusted Call to an Enclave Project 24
Slide 25: Add a Trusted Call to an Enclave Project
Demo Add a Trusted Call to an Enclave Project 25
Slide 26: Add a Trusted Call to an Enclave Project
Demo Add a Trusted Call to an Enclave Project 26
Slide 27: Add a Trusted Call to an Enclave Project
Demo Add a Trusted Call to an Enclave Project 27
Slide 28: Implement Enclave Functions
Demo Implement Enclave Functions 28
Slide 29: Implement the Enclave Application
Demo Implement the Enclave Application 29
Slide 30: Implement the Enclave Application
Demo Implement the Enclave Application 30
Slide 31: Implement the Enclave Application
Demo Implement the Enclave Application 31
Slide 32: Implement the Enclave Application
Demo Implement the Enclave Application 32
Slide 33: Conclusion
Conclusion
Slide 34: Wrap-up
Wrap-up Hardware-based protection for sensitive data SDK auto-generates many necessary wrapper functions Build trusted apps with familiar tools Visit the links at the end of the webinar to learn more and see other examples 34
Slide 35: Additional Resources
Additional Resources Intel® SGX sample code and tutorials: https://software.intel.com/en- us/sgx/code-samples Intel SGX forum: https://software.intel.com/en-us/forums/intel-software-guard- extensions-intel-sgx Intel SGX for Linux*: https://01.org/intel-software-guard-extensions Intel SGX at the Inte
Slide 36: Q&A
Q&A 36
Slide 37: Slide 37
Slide 38: Legal Notices and Disclaimers
Legal Notices and Disclaimers Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufactu