\HeadingLevelA{Introduction}
\label{sec:introduction}

% NOTE: The \inputs that pull in naked paragraphs, as opposed to whole
%       sections, must be separated by empty lines.

Between the Snowden revelations and the seemingly unending series of
high-profile hacks of the past few years, the public's confidence in software
systems has decreased considerably. At the same time, key initiatives such as
cloud computing and the IoT (Internet of Things) are gaining popularity but require users to place much trust in the systems providing these services.
We must therefore develop capabilities to build software systems with compelling security, and gain back our users' trust.

This manuscript is the second in a two part survey of the state of the art in secure processor systems, with a specific focus on remote software attestation and software isolation.
Part I~\citep{part1} established relevant background in computer system design (\S~\eref{I}{sec:architecture_background}) and security primitives (\S~\eref{I}{sec:security_background}), and surveyed relevant prior work (\S~\eref{I}{sec:sgx_related}). The same work discussed the attested software isolation container (enclave): a modern primitive for modular secure software and trusted remote computation, as exemplified by Intel's Software Guard Extensions (\S~\eref{I}{sec:sgx_model}).

This manuscript extends the discussion of enclaves and SGX by surveying the implementation and security properties of SGX (\S~\ref{sec:sgx}), and documents the authors' concerns with its vulnerabilities to several classes of software attacks.
Informed by the successes and shortcomings of SGX, this manuscript also discusses the MIT Sanctum processor (\S~\ref{sec:sanctum}): a secure processor that offers an equivalent programming model with strong security guarantees against an insidious software threat model including cache timing and memory access pattern attacks. With this work, we hope to enable a shift in discourse in secure hardware architecture away from plugging specific security holes to a principled approach to eliminating attack surfaces.

\input{text/intro/a_case_for_isolation.tex}

\input{text/intro/sgx_is_not_the_answer.tex}

\input{text/intro/sanctum_contributions.tex}



%\input{text/intro/sgx_lightning_tour.tex}

%\input{text/intro/troubling_sgx_findings.tex}

%TODO: In the absence of miraculous improvements to Fully-Homorphic Encryption
%\citep{gentry2009fhe, van2010fhe, naehrig2011fhe, brakerski2014fhe},
