Enclave Cache Communication via L1 Memory Threads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current trusted execution environments (TEEs) like Intel SGX lack the ability to facilitate fast and reliable direct communication between enclaves, relying on costly operating system calls (OCALL/ECALL) that result in significant performance degradation due to context switches.
Innovation Solution
Implementing a method that uses the cache memory of a processor to enable direct communication between enclaves by instantiating communication threads in each enclave to read/write data to the cache, allowing enclaves to send and receive messages without operating system intervention, leveraging the L1 cache as a communication channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OCALL/ECALL is used for inter-enclave communication, then communication between enclaves is enabled, but performance is greatly degraded due to costly context switches
Solution Approach 1:
The patent introduces cache memory as an intermediary communication channel between enclaves. Instead of directly calling OS functions (OCALL/ECALL), enclaves write to and read from shared cache memory locations, using the cache as a mediator that enables communication without requiring costly context switches to the operating system.
Solution Approach 2:
The patent extracts the communication function from the operating system kernel space and moves it to user space within the enclaves themselves. By implementing communication threads that directly access cache memory, the solution removes the dependency on OS-mediated OCALL/ECALL mechanisms, thereby eliminating the performance bottleneck caused by context switches.
2Reliability
If multiple OCALLs are used for data transfer, then complete data transmission is achieved, but execution time increases significantly
Solution Approach 1:
The patent segments the data transfer process into independent cache write and read operations that can be performed by communication threads within enclaves. By dividing the transfer into cache-based operations rather than requiring multiple sequential OCALLs, the solution maintains complete data transmission while reducing the time loss associated with repeated context switches.
3Productivity
If direct cache-based communication is implemented, then communication speed is improved, but device complexity increases
Solution Approach 1:
The patent makes the cache memory serve multiple functions: it continues to perform its traditional role of storing frequently accessed data while simultaneously functioning as a communication channel between enclaves. This multi-functionality allows the system to achieve fast communication without adding dedicated communication hardware or significantly increasing device complexity.
Solution Approach 2:
The enclaves perform their own communication operations by executing communication threads that directly access cache memory. Instead of requiring the operating system to manage and mediate each communication event, the enclaves serve themselves by implementing their own send and receive operations through cache access, thereby simplifying the overall system architecture.
Data Source
AI summary
A method executes inter-enclave communication via cache memory of a processor. The method includes: instantiating a first enclave such that it is configured to execute a first communication thread, which is configured to read/write data to the cache memory; instantiating a second enclave such that it is configured to execute a second communication thread, which is configured to read/write data to cache memory; executing, by the first enclave, the first communication thread to send message data to the second enclave, executing the first communication thread comprising writing the message data to the cache memory; and executing, by the second enclave, the second communication thread to receive the message data. Executing the second communication thread can include: monitoring the cache memory to determine whether the data message is being sent; and based upon determining the data message is being sent, reading from the cache memory to receive the data message.