\HeadingLevelB{The Aegis Secure Processor}
\label{sec:sgx_related_aegis}

The Aegis secure processor \citep{suh2003aegis} relies on a security kernel in the operating system to isolate containers, and includes the kernel's cryptographic hash in the measurement reported by the software attestation signature.  \citep{suh2003aegis} also describes a variant architecture that assumes an untrusted OS.
\citep{aegis_impl} argued that
Physical Unclonable Functions (PUFs) \citep{gassend2002puf} can be used to
endow a secure processor with a tamper-resistant private key, which is required
for software attestation. PUFs do not have the fabrication process drawbacks of
EEPROM, and are significantly more resilient to physical attacks than e-fuses.

Aegis relies on a trusted security kernel to isolate each container from the
other software on the computer by configuring the page tables used in address
translation. The security kernel is a subset of a typical OS kernel, and
handles virtual memory management, processes, and hardware exceptions. As the
security kernel is a part of the \textit{trusted code base} (TCB), its
cryptographic hash is included in the software attestation measurement. The
security kernel uses processor features to isolate itself from the untrusted
part of the operating system, such as device drivers.

The Aegis memory controller encrypts the cache lines in one memory range, and
HMACs the cache lines in one other memory range. The two memory ranges can
overlap, and are configurable by the security kernel. Thanks to the two ranges,
the memory controller can avoid the latency overhead of cryptographic
operations for the DRAM outside containers. Aegis was the first secure processor not vulnerable to physical
replay attacks, as it uses a Merkle tree construction \citep{gassend2003merkle}
to guarantee DRAM freshness. The latency overhead of the Merkle tree is greatly
reduced by augmenting the L2 cache with the tree nodes for the cache lines.

Aegis' security kernel allows the OS to page out container memory, but verifies
the correctness of the paging operations. The security kernel uses the same
encryption and Merkle tree algorithms as the memory controller to guarantee the
confidentiality and integrity of the container pages that are swapped out from
DRAM. The OS is free to page out container memory, so it can learn a
container's memory access patterns, at page granularity. Aegis containers are
also vulnerable to cache timing attacks.
