Introduction

Conventional approaches to securing applications have relied primarily on software to provide protection. However good the software implementation may be, an attacker that is able to gain privileged access would conceivably be able to circumvent software defenses. A recent and disruptive technology introduced in many new processor models provides a better security and privacy model. It allows you to run an application in an environment that is isolated from the host, while running on the same machine. In the case of Intel®, the key enabler is the hardware-level memory isolation introduced by Intel® Software Guard Extensions, that creates an encrypted partition of the memory. Somewhat similar functionality is offered by AMD in the form of Secure Encrypted Virtualization (SEV).

Intel® Software Guard Extensions (Intel® SGX) brings a hardware root-of-trust and program isolation to commodity processors, enabling the handling of sensitive data in a trusted execution environment called a secure enclave.

Secure enclaves enable running an application so that its contents and the data it handles are completely inaccessible to any other entities. Such “blocked” entities include privileged users on the guest OS, the hypervisor or the host OS itself.

This guide is structured as follows:

This section describes typographical and other conventions used in this guide.

You can find definitions of specialized vocabulary in the Glossary of Terms.

Text colored like this is a link to another document, either in this guide or elsewhere on the web.

Text in monospace type represents text that appears in a terminal or in the filesystem of a host. We use it to refer to the names of commands and of files used by the Anjuna SGX Runtime and in examples.

A block of text in monospace type represents an interaction with a host’s shell in the terminal, or the text of a file.

Some code blocks are shortened to emphasize only the relevant configuration. A line with <snip>…​ indicates that some lines have been removed from the full configuration.

The following text illustrates the appearance of a command in a terminal shell. You can copy the text by hovering over it and clicking on the clipboard icon to the right.

Text in <angle brackets> in examples stands for text to be replaced.

For example, in this text:

replace <username> with an actual username.

Tabs represent different versions of instructions for different platforms. Usually you will only need to run the version for your current platform.

For example, the following tabs represent different Dockerfile base images depending on your Ubuntu version.