OVH / Security - Intel SGX (Software Guard Extensions)
Does SGX affect performance ? Managing Intel SGX on a dedicated server
How to Enable and Disable Intel SGX from the OVHcloud Manager
Slow initialization of SGX Enclave



Intel SGX delivers advanced hardware security encryption features in order to isolate parts of code and data that are specific to each application. In this article, we will cover how to enable and disable SGX from the OVHcloud Manager.

What is Intel Software Guard Extensions SGX?

Intel Software Guard Extensions (SGX) is a feature available with Intel Xeon E processors. This technology delivers advanced hardware and RAM security encryption features, meaning you can isolate parts of the code and data that are specific to each application. By enabling this feature, you will protect your software and most sensitive data against divulgation and modification.

Why use the SGX feature?

Data security is an increasingly significant subject for businesses hosting applications in the cloud. Only the data stored and in-transit data get encryption mechanisms. DATA at Rest Encryption is used for storing resting data, and TLS protocol for encrypting network communications. However, there is still another important part that needs to be secured: access control for data that is being processed.

Securing data that is in use





Intel Software Guard Extensions is a set of instructions that optimize security for code and data. SGX is available for servers in the Infrastructure range, including the Intel Xeon E processor.
Enabling this feature will give you a secure runtime environment by isolating part of your servers physical memory, called a security enclave. This way, you will protect access to data that is being processed, or code that is being run.
Your applications can use these enclaves to protect critical data, such as passwords, encryption keys, and sensitive data for your users. Even if your operating system or hypervisor is compromised, your data will still be protected.

-------------------------------------------
Secure data that is in use

Strengthen your Defence in-depth (DiD) strategy

Intel Software Guard Extensions (SGX) is a powerful hardware security solution that enables users to isolate applications in encrypted memory enclaves. Intel SGX is built into the processor, so applications are protected against malware and unauthorised users even if the operating system or hypervisor layers are compromised. The result is superior data protection, which is perfect for companies that process sensitive information particularly in the healthcare and financial service sectors.

Go further securing your applications

Businesses can no longer rely on perimeter defences alone to keep their applications secure. This is why it is essential to adopt security solutions that protect the memory where the applications are stored. Intel SGX is the ultimate solution, as it partitions data and application code in encrypted, reliable enclaves. By using OVHcloud dedicated servers equipped with Intel SGX, you get a protected memory size of up to 512GB.

What is Intel Software Guard Extensions (SGX)?
What is Intel SGX

Protect your data with a wide range of compatible products

Intel SGX is available with 3rd generation Intel Xeon E and Intel Xeon Scalable processors. It is also included with our ADV-1, ADV-2 and ADV-6 dedicated servers.

Secure your data while it is in use
As software layer security gets improved, hackers are quick to jump into the stack in search of new vulnerabilities. Companies should start by securing the very first layer: the silicon.
Reliable enclaves provided by Intel SGX are perfect for storing critical data, such as passwords, customer information, medical records, financial data, and encryption keys.
Intel SGX protects against:

  • Malicious insiders with administrative privileges
  • Hackers who exploit hypervisor or OS bugs
  • Third parties who access certain data without the consent of its owner


---------------------------------------------
Enabling SGX in the OVHcloud Manager

To enable SGX, first log into the OVHcloud Manager. Click Server at the top of the page and then select the server on which you wish to enable SGX from the left-hand sidebar. Scroll down to the "Advanced features" box and click the ellipsis (...) next to "Security - Intel SGX (Software Guard Extensions)". Select Enable SGX from the drop-down menu.

On the following screen, click the Enable button.

You can either choose to enable SGX with a specific amount of reserved memory or enable it by allowing your software to automatically reserve the memory it needs. Once you have made your choice, click Confirm.

Click Confirm on the following pop-up menu. Your server will reboot, so allow a few minutes before accessing your server again

Disabling SGX from the OVHcloud Manager

To disable SGX, navigate to the "Advanced features" box as we did in the first section and click the ellipsis (...) next to "Security - Intel SGX (Software Guard Extensions). Select Modify SGX from the drop-down menu.

Choose the Disable option and then click Confirm.

Click Confirm on the following pop-up menu. Your server will reboot, so allow a few minutes before accessing your server again.
Conclusion

Managing SGX with OVHcloud is a seamless process that helps you manage the security of your server.

-----------------------------------------
SGX
-------------------------------------------------
does enabling SGX on intel motherboards slow down the speed of computer operations ?

It must. The question is how much, and I am sure it varies by application

1. How does SGX affect CPU performance?
SGX (Software Guard Extensions) is a feature of Intel processors that allows for secure enclave execution of code. While it provides additional security, it can also have an impact on CPU performance. The exact impact will depend on the specific workload and how it uses SGX, but in general, there can be a slight decrease in performance due to the additional overhead of securing the enclave.

2. Does enabling SGX affect the overall system performance?

Enabling SGX on a system can have a small impact on the overall performance, but it is generally minimal. The main factor that can affect system performance is the additional memory usage that SGX requires, which can impact other applications running on the system. 3.

Can SGX cause compatibility issues with certain applications?
In general, SGX should not cause compatibility issues with applications. However, some older or poorly designed applications may not be compatible with SGX and may require updates or modifications to run properly. It is always recommended to test any critical applications before enabling SGX on a production system.

4. Is there a noticeable difference in performance between SGX-enabled and non-SGX-enabled systems?
 The difference in performance between SGX-enabled and non-SGX-enabled systems will vary depending on the workload and the specific SGX implementation. In general, there may be a slight decrease in performance on SGX-enabled systems due to the additional security measures, but this should not be significant for most users.

5. Are there any ways to optimize SGX performance?
There are a few ways to optimize SGX performance, such as using larger enclaves, minimizing the use of system calls within the enclave, and using optimized memory allocation techniques. However, these optimizations may require additional development effort and may not be necessary for all applications. It is recommended to consult the SGX documentation for more specific guidance on optimizing performance for a particular use case.

Reference: https://www.physicsforums.com/thread...rmance.884517/

, Shared hosting
app connections

:

.

Enabling or disabling SGX might impact the functionality of certain applications. SGX can have an impact on performance, so consider this when making a decision. Enabling SGX may provide security benefits but could potentially affect the overall performance of your applications.


OVH OVH - Spam - Refund commitment
:
https://support.us.ovhcloud.com/hc/e...Hcloud-Manager
https://www.ovhcloud.com/en-gb/bare-...rd-extensions/
https://help.ovhcloud.com/csm/en-ded...icle=KB0044005
https://us.ovhcloud.com/bare-metal/i...rd-extensions/
https://www.physicsforums.com/thread...rmance.884517/
https://jbeekman.nl/blog/2015/10/sgx...re-first-look/
https://community.intel.com/t5/Intel...ve/m-p/1354075