Snort Intrusion Detection System with Intel Software Guard Extension (Intel SGX).

摘要: Network Function Virtualization (NFV) promises the benefits of reduced infrastructure, personnel, and management costs by outsourcing network middleboxes to public or private cloud. Unfortunately, running functions in cloud entails security challenges, especially for complex stateful services. In this paper, we describe our experiences with hardening king - Intrusion Detection Systems (IDS) using Intel Software Guard Extensions (Intel SGX) technology. Our IDS secured SGX, called SEC-IDS, is an unmodified Snort 3 a DPDK layer that achieves 10Gbps line rate. SEC-IDS guarantees computational integrity all code inside SGX enclave. At same time, near-native performance, throughput close 100 percent vanilla 3, retaining I/O outside experiments indicate performance only constrained modest Enclave Page Cache size available on current Skylake based E3 Xeon platforms. Finally, kept porting effort minimal Graphene-SGX library OS. Only 27 Lines Code (LoC) were modified 178 LoC itself.