Intel SGX provisions shielded executions for security-sensitive computation, but lacks support for trusted system services (TSS), such as clock, network and filesystem. This makes \textit{enclaves} vulnerable to Iago attacks~\cite{DBLP:conf/asplos/CheckowayS13} in the face of a powerful malicious system. To mitigate this problem, we present Aurora, a novel architecture that provides TSSes via a secure channel between enclaves and devices on top of an untrusted system, and implement two types of TSSes, i.e. clock and end-to-end network. We evaluate our solution by porting SQLite and OpenSSL into Aurora, experimental results show that SQLite benefits from a \textit{microsecond} accuracy trusted clock and OpenSSL gains end-to-end secure network with about 1ms overhead.
@article{arxiv.1802.03530,
title = {Aurora: Providing Trusted System Services for Enclaves On an Untrusted System},
author = {Hongliang Liang and Mingyu Li and Qiong Zhang and Yue Yu and Lin Jiang and Yixiu Chen},
journal= {arXiv preprint arXiv:1802.03530},
year = {2021}
}