Enclave Computing

In recent years, more flexible TEEs have been proposed that enable multiple “worlds”, belonging to different service providers, to exist on the same platform. These “enclaves” are self-contained areas that execute without the co-operation of other enclave owners. In the wider community, the term ‘enclave’ has been used very loosely, encompassing many of the technologies described in this book, from Docker-style containers to various hardware platforms and TrustZone-based applications. In this book, we consider enclaves to be a particular type of TEE implementation. We define them as flexible areas for hosting sensitive programs from different stakeholders in a hardware-isolated environment, which are protected from privileged threats from the main operating system. This chapter presents technologies that fall into this definition, includ‘ing Intel’s Software Guard Extensions (Intel SGX), Intel Trust Domain Extensions (Intel TDX), and several academic proposals, such as Komodo, Sanctum, and Keystone.