Skip to content

Commit 70ba9aa

Browse files
Le-CaignecLe-Caignec
committed
feat: add visual representations and detailed explanations for Intel SGX and TDX technologies
1 parent 96e8f19 commit 70ba9aa

File tree

3 files changed

+226
-3
lines changed

3 files changed

+226
-3
lines changed

‎src/get-started/protocol/tee/intel-sgx.md‎

Lines changed: 96 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,40 @@ applications.
3737
**Analogy**: SGX is like installing a small, specialized safe inside your office
3838
for specific valuable items.
3939

40-
## SGX with iExec
40+
### Visual Representation
4141

42-
iExec has built a comprehensive SGX infrastructure that makes it easy for
43-
developers to create secure, privacy-preserving applications.
42+
```mermaid
43+
graph TB
44+
OS[Operating System<br/>Can see everything]
45+
App[Regular Application<br/>Visible & Vulnerable]
46+
Enclave[🔒 SGX Enclave<br/>Protected]
47+
Data[Sensitive Code & Data<br/>Encrypted]
48+
OS --> App
49+
App --> Enclave
50+
Enclave --> Data
51+
style Enclave fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
52+
style Data fill:#ffffff,stroke:#00ff00,stroke-width:2px,color:#000000
53+
```
54+
55+
## SGX Technology Details
56+
57+
### How SGX Works
58+
59+
1. **Enclave Creation**: SGX creates a secure memory region (enclave) that only
60+
the CPU can access
61+
2. **Code Isolation**: Sensitive code runs inside the enclave, isolated from the
62+
rest of the system
63+
3. **Memory Encryption**: All data in the enclave is automatically encrypted
64+
4. **Integrity Protection**: The enclave can prove it's running the correct,
65+
unmodified code
66+
67+
### SGX Limitations
68+
69+
With native Intel® SGX technology, the OS is not a part of the Trusted
70+
Computing Base (TCB), hence system calls and kernel services are not available
71+
from an Intel® SGX enclave. This can be limiting as the application will not be
72+
able to use File System and sockets directly from the code running inside the
73+
enclave.
4474

4575
### iExec's SGX Infrastructure
4676

@@ -53,3 +83,66 @@ iExec provides a complete SGX ecosystem that includes:
5383
execution
5484
- **🔗 Blockchain Integration**: Decentralized coordination and payment
5585
- **📦 Scone Framework**: High-level development framework for SGX applications
86+
87+
### Why iExec Uses Scone
88+
89+
To build Confidential Computing (TEE) applications with SGX, iExec uses the
90+
high-level **Scone framework** instead of requiring developers to manipulate the
91+
Intel® SGX SDK directly.
92+
93+
#### Scone Framework Benefits
94+
95+
At a high-level, Scone protects the confidentiality and integrity of the data
96+
and the code without needing to modify or recompile the application. The
97+
[Scone](https://scontain.com/) framework resolves the limitations of native SGX
98+
and reduces the burden of porting the application to Intel® SGX.
99+
100+
#### How Scone Works
101+
102+
More precisely, Scone provides a C standard library interface to container
103+
processes. System calls are executed outside of the enclave, but they are
104+
shielded by transparently encrypting/decrypting application data. Files stored
105+
outside of the enclave are therefore encrypted, and network communication is
106+
protected by Transport Layer Security (TLS).
107+
108+
For a deeper understanding, you can have a look to the official
109+
[Scone documentation](https://sconedocs.github.io/).
110+
111+
### iExec SGX Workflow
112+
113+
```mermaid
114+
graph TD
115+
Dev[Developer]
116+
Build[Build with Scone]
117+
Deploy[Deploy to iExec]
118+
Worker[SGX Worker Selected]
119+
Enclave[SGX Enclave Created]
120+
Execute[Secure Execution]
121+
Proof[Proof of Contribution]
122+
Result[Results]
123+
Dev --> Build
124+
Build --> Deploy
125+
Deploy --> Worker
126+
Worker --> Enclave
127+
Enclave --> Execute
128+
Execute --> Proof
129+
Proof --> Result
130+
style Enclave fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
131+
style Execute fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
132+
```
133+
134+
## What's Next?
135+
136+
**Learn about the next generation**:
137+
138+
- **[Intel TDX Technology](/get-started/protocol/tee/intel-tdx)** -
139+
Next-generation VM-level TEE technology
140+
- **[SGX vs TDX Comparison](/get-started/protocol/tee/sgx-vs-tdx)** - Detailed
141+
comparison of both technologies
142+
143+
**Ready to build with SGX?** Check out the practical guides:
144+
145+
- **[Build & Deploy](/guides/build-iapp/build-&-deploy)** - Create your first
146+
SGX application
147+
- **[Advanced SGX Development](/guides/build-iapp/advanced/create-your-first-sgx-app)** -
148+
Deep dive into SGX development

‎src/get-started/protocol/tee/intel-tdx.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,41 @@ machines.
4545
**Analogy**: TDX is like moving your entire office into a secure building where
4646
everything is protected.
4747

48+
### Visual Representation
49+
50+
```mermaid
51+
graph TB
52+
Hypervisor[Hypervisor<br/>Cannot see inside TDX]
53+
TrustDomain[🔒 TDX Trust Domain<br/>Entire VM Protected]
54+
App[Your Complete Application<br/>All Protected]
55+
Data[OS, Libraries, Data<br/>All Encrypted]
56+
Hypervisor --> TrustDomain
57+
TrustDomain --> App
58+
App --> Data
59+
style TrustDomain fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
60+
style Data fill:#ffffff,stroke:#00ff00,stroke-width:2px,color:#000000
61+
```
62+
63+
## TDX Technology Details
64+
65+
### How TDX Works
66+
67+
1. **Trust Domain Creation**: TDX creates secure virtual machines called "trust
68+
domains"
69+
2. **VM-Level Isolation**: Entire virtual machines run in isolated, secure
70+
environments
71+
3. **Large Memory Support**: Significantly larger secure memory space compared
72+
to SGX
73+
4. **Legacy Compatibility**: Existing applications can run with minimal
74+
modifications
75+
76+
### TDX Advantages
77+
78+
- **Larger Memory**: Multi-GB+ secure memory space vs limited SGX memory
79+
- **Easier Migration**: "Lift and shift" approach for existing applications
80+
- **Better Performance**: Optimized for complex, memory-intensive workloads
81+
- **VM-Level Security**: Protects entire virtual machines, not just applications
82+
4883
## TDX with iExec
4984

5085
iExec is actively exploring TDX technology to expand the platform's capabilities
@@ -59,3 +94,55 @@ iExec provides experimental TDX support through:
5994
- **🔐 Secret Management Service**: SMS support for TDX applications
6095
- **📋 Task Verification**: Proof of contribution for TDX executions
6196
- **🔗 Blockchain Integration**: Decentralized coordination and payment
97+
98+
### iExec TDX Workflow
99+
100+
```mermaid
101+
graph TD
102+
Dev[Developer]
103+
Build[Build TDX App]
104+
Deploy[Deploy to iExec]
105+
Worker[TDX Worker Selected]
106+
TrustDomain[TDX Trust Domain Created]
107+
Execute[Secure Execution]
108+
Proof[Proof of Contribution]
109+
Result[Results]
110+
Dev --> Build
111+
Build --> Deploy
112+
Deploy --> Worker
113+
Worker --> TrustDomain
114+
TrustDomain --> Execute
115+
Execute --> Proof
116+
Proof --> Result
117+
style TrustDomain fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
118+
style Execute fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
119+
```
120+
121+
## When to Use TDX
122+
123+
**TDX is ideal for**:
124+
125+
- 💾 Working with memory-intensive applications
126+
- 🔄 Running existing applications with minimal changes
127+
- 🚀 Running complex workloads with VM-level protection
128+
129+
## What's Next?
130+
131+
**Learn about the foundation**:
132+
133+
- **[Intel SGX Technology](/get-started/protocol/tee/intel-sgx)** -
134+
First-generation application-level TEE technology
135+
- **[SGX vs TDX Comparison](/get-started/protocol/tee/sgx-vs-tdx)** - Detailed
136+
comparison of both technologies
137+
138+
**Ready to experiment with TDX?** Check out the practical guides:
139+
140+
- **[Build Intel TDX App (Experimental)](/guides/build-iapp/advanced/create-your-first-tdx-app)** -
141+
Build TDX applications with traditional deployment and iApp Generator
142+
- **[Create Your First TDX App](/guides/build-iapp/advanced/create-your-first-tdx-app)** -
143+
Build TDX applications
144+
145+
**For production applications, use SGX**:
146+
147+
- **[Build & Deploy](/guides/build-iapp/build-&-deploy)** - Create
148+
production-ready SGX applications

‎src/get-started/protocol/tee/introduction.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,49 @@ special security measures that keep its contents completely private and secure.
4545
| No hardware security guarantees | Hardware-level security protection |
4646
| Like working in a public space | Like working in a secure, private room |
4747

48+
### Visual Representation
49+
50+
**Regular Computing:**
51+
52+
```mermaid
53+
graph TB
54+
OS1[Operating System<br/>Can see everything]
55+
App1[Your Application<br/>Visible & Vulnerable]
56+
Data1[Sensitive Data<br/>Exposed]
57+
OS1 --> App1
58+
App1 --> Data1
59+
style Data1 fill:#ffffff,stroke:#ff0000,stroke-width:2px,color:#000000
60+
style OS1 fill:#ffffff,stroke:#000000,stroke-width:1px,color:#000000
61+
style App1 fill:#ffffff,stroke:#000000,stroke-width:1px,color:#000000
62+
```
63+
64+
**TEE Computing:**
65+
66+
```mermaid
67+
graph TB
68+
OS2[Operating System<br/>Cannot see inside TEE]
69+
App2[Regular Application Parts]
70+
TEE[🔒 TEE Enclave<br/>Protected]
71+
Data2[Sensitive Code & Data<br/>Encrypted]
72+
OS2 --> App2
73+
App2 --> TEE
74+
TEE --> Data2
75+
style TEE fill:#ffffff,stroke:#0000ff,stroke-width:2px,color:#000000
76+
style Data2 fill:#ffffff,stroke:#00ff00,stroke-width:2px,color:#000000
77+
style OS2 fill:#ffffff,stroke:#000000,stroke-width:1px,color:#000000
78+
style App2 fill:#ffffff,stroke:#000000,stroke-width:1px,color:#000000
79+
```
80+
81+
## How TEE Works
82+
83+
### Core Principles
84+
85+
1. **Hardware Protection**: Special CPU features create isolated, secure areas
86+
2. **Memory Encryption**: All data in the secure area is automatically encrypted
87+
3. **Access Control**: Only authorized code can enter the secure area
88+
4. **Integrity Verification**: The system can prove it's running the correct
89+
code
90+
4891
## TEE Technology Evolution
4992

5093
TEE technologies have evolved to address different use cases:

0 commit comments

Comments
 (0)