Instruct: Identify the main and secondary category of Arxiv papers based on the titles and abstracts
Query: EnclaveDom: Privilege Separation for Large-TCB Applications in Trusted
  Execution Environments   Trusted executions environments (TEEs) such as Intel(R) SGX provide
hardware-isolated execution areas in memory, called enclaves. By running only
the most trusted application components in the enclave, TEEs enable developers
to minimize the TCB of their applications thereby helping to protect sensitive
application data. However, porting existing applications to TEEs often requires
considerable refactoring efforts, as TEEs provide a restricted interface to
standard OS features. To ease development efforts, TEE application developers
often choose to run their unmodified application in a library OS container that
provides a full in-enclave OS interface. Yet, this large-TCB development
approach now leaves sensitive in-enclave data exposed to potential bugs or
vulnerabilities in third-party code imported into the application. Importantly,
because the TEE libOS and the application run in the same enclave address
space, even the libOS management data structures (e.g. file descriptor table)
may be vulnerable to attack, where in traditional OSes these data structures
may be protected via privilege isolation.
  We present EnclaveDom, a privilege separation system for large-TCB TEE
applications that partitions an enclave into tagged memory regions, and
enforces per-region access rules at the granularity of individual in-enclave
functions. EnclaveDom is implemented on Intel SGX using Memory Protection Keys
(MPK) for memory tagging. To evaluate the security and performance impact of
EnclaveDom, we integrated EnclaveDom with the Graphene-SGX library OS. While no
product or component can be absolutely secure, our prototype helps protect
internal libOS management data structures against tampering by
application-level code. At every libOS system call, EnclaveDom then only grants
access to those internal data structures which the syscall needs to perform its
task.

29
The categories of this paper are: funct-an
27
The categories of this paper are: comp-gas
26
The categories of this paper are: bayes-an
35
The categories of this paper are: mtrl-th
0
The categories of this paper are: hep-ph
2
The categories of this paper are: math
34
The categories of this paper are: chem-ph
36
The categories of this paper are: cmp-lg
22
The categories of this paper are: chao-dyn
28
The categories of this paper are: alg-geom
9
The categories of this paper are: nlin
31
The categories of this paper are: ao-sci
20
The categories of this paper are: acc-phys
11
The categories of this paper are: hep-lat
5
The categories of this paper are: gr-qc
3
The categories of this paper are: physics