Occlum - A library OS empowering everyone to run every application in secure enclaves

Why Occlum

Modern applications are being increasingly deployed to untrusted infrastructure, e.g., public clouds, IoT devices, blockchain nodes, etc. While a new class of hardware security technology known as enclaves (e.g., Intel SGX) can provide the much-needed protection in these scenarios, secure enclaves are well known to be hard to program.

Occlum makes running applications inside enclaves easy. It allows one to run unmodified programs inside enclaves with just a few simple commands. And Occlum is open-source and free to use. So, instead of spending months to port your code into enclaves, you can run your applications inside enclaves now!

How to Use

If you were to write a Hello World program using some Enclave SDK (e.g., Intel SGX SDK), the project would consist of hundreds of lines of code. Thanks to Occlum, you can be freed from writing any extra enclave-aware code and only need to type some simple commands: occlum init, occlum build, and occlum run.

Features

Efficient Multitasking

Occlum offers light-weight LibOS processes that share the single address space of an enclave. These light-weight LibOS processes can be 1,000X faster on startup and 3X faster on inter-process communication, compared to the traditional heavy-weight, per-enclave LibOS processes.

Multiple File Systems

Occlum supports various types of file systems, e.g., read-only hashed FS (for integrity protection), writable encrypted FS (for confidentiality protection), untrusted host FS (for convenient data exchange between the LibOS and the host OS), etc.

Memory Safety

Occlum is built from scratch with Rust, which helps to minimize low-level, memory-safety bugs and thus more trustworthy to host security-critical applications.

Ease of Use

Occlum provides user-friendly build and utility command-line tools. Running applications on Occlum inside SGX enclaves can be as simple as only typing several shell commands.

Use Cases

Secret Management

Secret management is essential in today's microservice architecture. However, the data store of your secret management system becomes a centralized weakness. If it got comprised, all your secrets are in danger. Occlum allows you to fortify the secret store by running it in hardware-encrypted memory.

Blockchain Privacy

Privacy in blockchain transactions (smart contracts) is a roadblock for blockchain to enter a serious business market. With Occlum, even a smart contract gets executed at a random node of the chain, the content and details of the contract still remain confidential.

Data Protection at Edge

With the rise of Edge Computing, more and more code and data are running at heterogeneous remote sites, which means that the IP property (both source and data) are exposed. Occlum allows you to deploy your code/data at those untrusted edges, with the necessary confidence that they are properly protected.

Federated ML

Data exchange among multiple non-mutually-trusted parties is tricky. The problem lies at not only the lack of trust but also very often the jurisdiction requirement. Combing with Occlum, federated ML (Machine Learning) enables different entities to safely share the data, with no one having any access to the data.