应用内存超售在虚拟化环境中优化SGX的性能  

Optimizing SGX Performance in Virtualized Environments by Memory Oversubscription

作　　者：姚旭佳 吴新月 YAO Xujia;WU Xinyue(Software School, Shanghai JiaoTong University, Shanghai 200240, China)

机构地区：[1]上海交通大学软件学院,上海200240

出　　处：《微型电脑应用》2022年第1期139-141,共3页Microcomputer Applications

摘　　要：随着安全性在云计算中越来越受到关注,英特尔自2015年起提出了SGX。它提供enclave,并保护enclave中的应用程序免受不信任的软件(包括客户操作系统和虚拟机监视器)和硬件(英特尔CPU包除外)的攻击。然而,SGX只能支持256MB的enclave内存EPC。因此,在不同的虚拟机之间高效分配宝贵的EPC资源对整体性能至关重要。但是,现有的SGX内存虚拟化软件(例如官方的英特尔SGX SDK)只能在虚拟机之间静态地划分EPC资源,这显然与虚拟机的动态EPC要求不匹配。为此,提出了SGX内存超售的设计,可以显著提高SGX应用在虚拟机中的性能,与现有的静态分区方法相比,我们的设计可取得高达49.2%的性能提升。As security gains more attention in cloud computing,Intel SGX(Software Guard eXtentions)has become commercially available since 2015.It provides“enclave”to protect applications in enclaves from untrusted software(including guest OS and hypervisor)and hardware(except the Intel CPU package).Nevertheless,SGX can only support up to 256MB enclave memory called EPC(enclave page cache).Hence,efficiently allocating precious EPC resources among different VMs(virtual Machines)is critical to overall performance.However,existing SGX memory virtualization software(e.g.,the official Intel SGX SDK)can only statically partition the EPC resources among VMs,which obviously mismatches the dynamic EPC requirements of VMs.In this paper,we present a design of dynamically allocating EPC resource(i.e.,SGX memory oversubscription).The design can improve the performance of SGX applications in VMs.Compared to state-of-the-art Intel SGX SDK,the design can improve the performance by up to 49.2%.

关 键 词：英特尔SGX 虚拟化 内存超售 

分 类 号：TP316.4[自动化与计算机技术—计算机软件与理论] TP181[自动化与计算机技术—计算机科学与技术]