Gramine

Gramine enables legacy and complex applications to run inside SGX enclaves without source code modifications. It intercepts standard POSIX system calls and translates them into enclave-safe operations.

• Run Python, Java, and C/C++ applications as-is
• Supports multi-process applications via inter-process communication
• Handles dynamic loading of shared libraries inside the enclave
• Compatible with glibc and musl C libraries

Gramine uses a declarative manifest file to define the enclave's security properties, resource limits, and trusted files. This manifest acts as the enclave's constitution, specifying exactly what the application can access.

• Defines trusted vs. untrusted filesystem paths
• Controls environment variables and command-line arguments
• Sets enclave memory limits and thread counts
• Specifies SGX security flags like debug mode and EPC size
• The manifest is included in the enclave measurement for attestation

Gramine implements a split architecture where the application runs inside the enclave while a small untrusted shim handles interactions with the host OS. This minimizes the Trusted Computing Base (TCB).

• Application code and data remain encrypted in memory
• Host OS, hypervisor, and root user cannot inspect enclave memory
• System calls are marshalled across the enclave boundary securely
• Protects against privileged software attacks from the host

Gramine provides transparent encryption for all data that leaves the enclave boundary, ensuring that files written to disk and network communications remain protected.

• Enclave sealing binds encrypted data to the enclave's cryptographic identity
• Supports sealing to the enclave identity or the platform's sealing authority
• Protected files feature encrypts files transparently on read/write
• Enables secure persistent storage without trusting the host filesystem

Gramine integrates with Intel's Enhanced Privacy ID (EPID) and Data Center Attestation Primitives (DCAP) to enable remote parties to cryptographically verify the enclave's identity and integrity before exchanging secrets.

• Generates cryptographic quotes signed by the SGX hardware
• Supports RA-TLS for embedding attestation evidence in TLS certificates
• Enables secret provisioning workflows where keys are released only to verified enclaves
• Compatible with Microsoft Azure Attestation and Intel SGX Attestation Service

Gramine supports a wide range of language runtimes and frameworks out of the box, making it suitable for modern AI and cloud-native workloads without rewriting application logic.

• Python with NumPy, PyTorch, and TensorFlow for confidential ML inference
• Java and JVM-based applications
• Node.js and JavaScript runtimes
• Go and Rust compiled binaries
• Redis and Memcached for encrypted in-memory caching
• Nginx and Apache for confidential web serving

The cryptographic handshake that proves an enclave is genuine. Gramine integrates with Intel's Enhanced Privacy ID (EPID) and Data Center Attestation Primitives (DCAP) to generate verifiable evidence that:

• The enclave code matches a known measurement (hash)
• The hardware is authentic Intel silicon
• No tampering has occurred Remote parties use this to establish trust before sending secrets into the enclave.

Gramine provides APIs for sealing data to persistent storage. Sealing encrypts data with a key derived from the enclave's identity and the CPU's Root Seal Key, ensuring:

• Only the same enclave on the same platform can decrypt it
• Data at rest is cryptographically bound to the enclave
• The host OS cannot read sealed blobs This enables stateful confidential applications that survive restarts.

Gramine must contend with SGX's exposure to side-channel attacks like L1 Terminal Fault (L1TF) and Microarchitectural Data Sampling (MDS). The library OS implements mitigations including:

• Retpoline and LFENCE-based indirect branch control
• Page table isolation to prevent host snooping
• Constant-time cryptographic operations
• Integration with Intel's microcode patches Understanding these defenses is critical for security-sensitive deployments.