Shulou(Shulou.com)05/31 Report--

On Tuesday's Intel Security Day, the company explained the current and future vision of security-centric features in its hardware.

Intel's Anil Rao and Scott Woodgate started their talks and discussed Intel's SGX (Software Protection extension), but their report on the company's plans to introduce full-memory encryption into Intel's CPU in the future is more interesting.

Intel SGX announced in 2014 and launched Skylake Microarchitecture in 2015. It is one of the earliest hardware encryption technologies designed to protect memory areas from unauthorized users, including system administrators themselves. SGX is a set of x86_64CPU instructions that allow processes to create hardware-encrypted enclaves in memory. Data stored in encrypted enclaves can only be decrypted in the processor. Even so, it can only be decrypted at the request of instructions executed by the enclave itself.

As a result, even those who can access the root of the running system (the system administrator) cannot effectively read or change enclaves protected by SGX. This is to allow confidential and high-risk data processing on shared systems, such as cloud virtual machines. Shifting this workload from locally owned and operated data centers to large-scale public clouds can reduce operating costs and may lead to better uptime, scalability, and even lower power consumption.

Intel SGX has several problems. The first and most obvious point is that it is proprietary and vendor-specific. If you design an application that uses SGX to protect its memory, the application will run only on Intel processors. Second, you must design your application around SGX. You can't just turn on one switch.

The area of the SGX enclave is also limited. All enclaves on the system must be suitable for enclave page caching, which is currently limited to 128 megabytes per process, not 128 megabytes. Obviously, you can't install the entire operating system-- even most containers 3354-- in 128MIB, which means that application developers must carefully and extremely difficult decide which parts of memory are "confidential" and which are not.

Finally, the use of SGX can be severely affected by performance. In 2017, IBM company Danny Hannecker conducted extensive tests on the performance of SGX. He found that when many common workloads were executed in SGX enclaves, it was easy to see a 20 to 50 per cent drop in throughput.

As he made clear, Haneke's testing is not 100% perfect, especially in some cases, his compiler does not seem to produce as much optimized code as a compiler without SGX. Even if people decide to treat these cases as "potentially repairable," they can help highlight previous complaints that require careful development of applications dedicated to SGX use cases, rather than just flipping a hypothetical "yes, please encrypt this" switch.

Currently, the software protection extension is the only one offered by Intel. But after discussing the use of SGX in the real world, Rao turned his attention to the future of Intel technology-- especially full-memory encryption. Intel's full-memory encrypted version is called TME (full-memory encryption) or MKTM E (multi-key full-memory encryption). Unfortunately, these features are currently steam software. Although Intel submitted a huge Linux kernel patch to support these features last May, it still does not provide their real-world processors.

Since there are no processors available that support TME or MKTME, it makes sense to explain basic technical concepts with similar technologies that do exist today. AMD's SME (secure memory encryption) and SEV (secure encryption Virtualization). For obvious reasons, this is not part of Intel's presentation, but it is the only way to talk about the practical meaning of the concept being implemented.

Like SGX, small and medium-sized enterprises need some planning from developers. However, a stricter subset of SMEs, called TSME transparent secure memory encryption, will allow SMEs to encrypt the entire system memory. As a complete system function, TSME is enabled or disabled in the system's basic input and output system (or user interface). It does not require the special planning of application developers. Once enabled-- everything is encrypted, that's all.

AMD's memory encryption method has far less impact on performance than Intel S GX. In a 2018 presentation, researchers at Wayne State University and the University of Houston showed that while Intel's SGX had a significant impact on performance, most workloads were not affected by secure encryption virtualization at all (a subset of AMD SMEs that allows full virtual machine encryption, with a separate key for each overlaid virtual machine).

Since Intel's TME and MKTME are still hypothetical, it is impossible to make any bold predictions about their performance impact. However, taking the previous AMD as an example, we seem to have reason to expect that they will not have a real performance impact in use, unlike SGX.

Rao and Woodgate faced things bravely and talked about their application in Sky Blue. But it seems obvious that the system-wide memory encryption methods that have been implemented in AMD EpycCPU-- even in some of their desktop series-- will have a greater lasting impact. Slides about Intel's upcoming full-memory encryption are labeled "innovative", but they look more like catching up with established competitors.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.