SDVisor: Secure Debug Enclave with Hypervisor

Cloud computing is developing rapidly nowadays. The cloud computing infrastructure requires cloud users' complete confidence in cloud administrators. The importance of trust issue increases when come into joint cloud computing situation because substantial trust is necessary not only between customers and providers but also between different providers. Although cloud users may expect to keep their code and data to be secret, it is indeed difficult to promise. Various trusted executing environments are widely used to provide security guarantees to cloud computing. Among these Intel's Security Guard Extension (SGX) is now a common choice to protect sensitive code and data. SGX provide hardware supports to protect memory inside enclaves. However, the production mode SGX enclaves with full protection available can not be launched without a production license from Intel, while the free non-production enclaves are under the risk of leaking sensitive data to malicious privileged parties. To address this problem, we introduce SDVisor, a system aiming to achieve the security guarantees of Intel's SGX on enclaves without availability of production license. SDVisor provides a lightweight hypervisor which extends the SGX's safeguard policy to ensure the confidentiality and integrity of non-production enclaves. The enclaves are then named secure debug enclaves. SDVisor is also compatible with normal production enclaves so that production mode SGX-enabled applications can be executed originally as well. SDVisor leverages hardware virtualization to protect these secure debug enclaves so it maintains good performance.