Related Experiment Video
Updated: Jul 7, 2025
08:09
Efficient Isolation Protocol for B and T Lymphocytes from Human Palatine Tonsils
Published on: November 16, 2015
15.9K
Trust Beyond Border: Lightweight, Verifiable User Isolation for Protecting In-Enclave Services
Wenhao Wang1, Weijie Liu2, Hongbo Chen2
1State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China.
IEEE Transactions on Dependable and Secure Computing
|December 28, 2023
Summary
Intel Software Guard Extensions (SGX) TEEs lack user isolation. Liveries introduces lightweight, verifiable in-enclave user isolation for time-sharing services, protecting sensitive data with minimal overhead.
Area of Science:
- Computer Science
- Cybersecurity
- Systems Security
Background:
- Trusted Execution Environments (TEEs), like Intel's Software Guard Extensions (SGX), lack in-enclave isolation.
- This limitation prevents secure execution of multiple users' tasks within a single enclave, hindering real-world applications like shared machine learning models or microservices.
Purpose of the Study:
- To develop a technique for lightweight, verifiable in-enclave user isolation.
- To enable secure time-sharing services within a single enclave.
- To protect sensitive user data against adversaries even with enclave compromise.
Main Methods:
- Introduced Liveries, a novel technique for in-enclave user isolation.
- Implemented privilege restriction for in-enclave threads during enclave configuration.
- Developed integrity checks and sanitization for critical enclave data during user switches.
Main Results:
- Liveries provides lightweight in-enclave user isolation with only 1% performance overhead.
- The technique is verifiable, with approximately 3200 lines of code.
- Achieved protection of sensitive user data, including session keys, against compromised enclaves.
Conclusions:
- Liveries offers a viable solution for secure time-sharing in TEEs.
- The technique represents a significant step towards assured protection for real-world in-enclave services.
- Enables broader adoption of TEEs for multi-user sensitive applications.
Related Concept Videos
01:16Zones of Protection
175
In power systems, the entire setup is divided into protective zones to isolate faults and protect the rest of the network. These zones include generators, transformers, buses, transmission lines, distribution lines, and motors. Each zone can be visualized as a separate room in a house, with each room protected by its own circuit breaker.
Protective zones are defined by closed dashed lines, containing one or more components. A key characteristic of these zones is the strategic placement of...
Protective zones are defined by closed dashed lines, containing one or more components. A key characteristic of these zones is the strategic placement of...
175
01:27Line Protection with Impedance Relays
82
Coordinating time-delay overcurrent relays in complex radial systems and directional overcurrent relays in multi-source transmission loops can be challenging. Impedance relays address these issues by responding to the voltage-to-current ratio, specifically measuring the apparent impedance of a line. These relays become more sensitive during faults as current increases and voltage decreases, thereby reducing the apparent impedance.
Under normal conditions, low load currents keep the measured...
Under normal conditions, low load currents keep the measured...
82
01:19Masking and Demasking Agents
2.4K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
2.4K
01:09Censoring Survival Data
97
Survival analysis is a statistical method used to analyze time-to-event data, often employed in fields such as medicine, engineering, and social sciences. One of the key challenges in survival analysis is dealing with incomplete data, a phenomenon known as "censoring." Censoring occurs when the event of interest (such as death, relapse, or system failure) has not occurred for some individuals by the end of the study period or is otherwise unobservable, and it might have many different...
97
01:20Overview Of Cell Separation And Isolation
5.7K
Cell separation was first achieved in 1964 by S. H. Seal, who separated large tumor cells from the smaller blood cells using filtration. Two years later, Pohl and Hawk performed experiments on how cells respond differently to a nonuniform electric field based on the cell type. Such observations were the inception of cell separation methods, which allow isolating a single cell type from a heterogeneous sample.
5.7K
01:19Cyclic Processes And Isolated Systems
2.8K
A thermodynamic system with zero heat exchange and work is an isolated system. For these systems, the internal energy remains constant.
In the case of a non-isolated system, the change in the internal energy is zero only if the process is cyclic. A thermodynamic process is considered cyclic if the system undergoes a series of changes and returns to its initial state.
Consider a cyclic process that returns to its initial state, undergoing a four-step process. The heat transfer along each...
In the case of a non-isolated system, the change in the internal energy is zero only if the process is cyclic. A thermodynamic process is considered cyclic if the system undergoes a series of changes and returns to its initial state.
Consider a cyclic process that returns to its initial state, undergoing a four-step process. The heat transfer along each...
2.8K