Intel SGX

最新推荐文章于 2023-03-26 20:08:03 发布

JepsonWong

最新推荐文章于 2023-03-26 20:08:03 发布

阅读量3.4k

点赞数

CC 4.0 BY-SA版权

分类专栏：安全文章标签： Intel SGX 安全体系结构

本文链接：https://blog.youkuaiyun.com/u013710265/article/details/78183119

Intel SGX（软件防护扩展）是Intel架构的一组扩展，旨在为计算机上的安全关键计算提供完整性和保密性保障，即使特权软件可能恶意。SGX将代码和数据存储在受保护的内存中，通过Enclave Page Cache（EPC）管理，并使用Enclave Page Cache Map（EPCM）记录分配信息，确保隔离和安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Intel SGX

Intel’s Software Guard Extensions (SGX) is a set of extensions to the Intel architecture that aims to provide integrity and confidentiality guarantees to security-sensitive computation performed on a computer where all the privileged software (kernel, hypervisor, etc) is potentially malicious.

SGX Physical Memory Organization

The enclaves’ code and data is stored in Processor Reserved Memory (PRM), which is a subset of DRAM that cannot be directly accessed by other software, including system software and SMM code. The CPU’s integrated memory controllers also reject DMA transfers targeting the PRM, thus protecting it from access by other peripherals.

PRM range registers (PRMRR)

The Enclave Page Cache (EPC)

The contents of enclaves and the associated data struc- tures are stored in the Enclave Page Cache (EPC), which is a subset of the PRM.

The EPC is managed by the same system software that manages the rest of the computer’s physical memory.

Non-enclave software cannot directly access the EPC, as it is contained in the PRM. This restriction plays a key role in SGX’s enclave isolation guarantees, but creates an obstacle when the system software needs to load the initial code and data into a newly created enclave. The SGX design solves this problem by having the instructions that allocate an EPC page to an enclave also initialize the page. Most EPC pages are initialized by copying data from a non-PRM memory page.