Adaptive and Efficient Dynamic Memory Management for Hardware Enclaves

2025-04-22

AI Summary

Intel SGX2’s Enclave Dynamic Memory Management (EDMM) reduces enclave launch time but incurs substantial execution overhead due to frequent page-table operations. This work identifies, for the first time, a previously overlooked performance bottleneck—costly page-table updates under the mutually untrusted OS–enclave model. We propose an adaptive memory management mechanism tailored for TEEs, implemented in Gramine LibOS, that jointly optimizes low-overhead page-mapping updates and strong security isolation. Key contributions include: (i) fine-grained mapping caching, (ii) delayed commit with batched TLB invalidation validation, and (iii) security-boundary-aware memory allocation. Experimental evaluation shows our mechanism eliminates up to 58% of EDMM’s execution-time overhead while preserving 28–93% of its launch-time speedup. Consequently, it significantly improves end-to-end performance and deployment flexibility in dynamic enclave scenarios.

Technology Category

• Machine Learning: Graph-based Machine Learning
• Multiagent Systems: Mechanism Design
• Data Mining & Knowledge Management: Scalability, Parallel & Distributed Systems

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments

Abstract

The second version of Intel Software Guard Extensions (Intel SGX), or SGX2, adds dynamic management of enclave memory and threads. The first version required the address space and thread counts to be fixed before execution. The Enclave Dynamic Memory Management (EDMM) feature of SGX2 has the potential to lower launch times and overall execution time. Despite reducing the enclave loading time by 28--93%, straightforward EDMM adoption strategies actually slow execution time down by as much as 58%. Using the Gramine library OS as a representative enclave runtime environment, this paper shows how to recover EDMM performance. The paper explains how implementing mutual distrust between the OS and enclave increases the cost of modifying page mappings. The paper then describes and evaluates a series of optimizations on application benchmarks, showing that these optimizations effectively eliminate the overheads of EDMM while retaining EDMM's performance and flexibility gains.

Problem

• Optimize dynamic memory management in SGX2 enclaves
• Reduce performance overheads of EDMM adoption
• Improve enclave runtime efficiency with mutual distrust

Innovation

• Dynamic memory management for SGX2 enclaves
• Optimized EDMM performance via Gramine OS
• Mutual distrust mitigation with page mapping