Cloud service providers are adopting Trusted Execution Environments (TEEs) to provide hardware-guaranteed security to applications running on remote, untrusted data centers. However, migrating such applications still relies on the decade-old stop-and-copy method, which introduces large downtimes. Modern live-migration approaches such as pre-copy and post-copy do not work for TEE-based applications due to hardware-enforced restrictions. We propose ConstMig, a near-zero-downtime live-migration mechanism for large memory-footprint TEE-based applications. ConstMig is fully compatible with containers, virtual machines (VMs), and microVMs. Our prototype, built on Intel SGX, achieves near-zero downtime irrespective of enclave size and requires no additional hardware support. ConstMig reduces total downtime by 77 - 96% for a suite of SGX applications with multi-gigabyte memory footprints compared to state-of-the-art TEE-based migration solutions such as MigSGX.

翻译：云服务提供商正采用可信执行环境（TEE）为运行在远程不可信数据中心的应用提供硬件级安全保障。然而，迁移此类应用仍依赖于已有数十年历史的“停止-复制”方法，这会引入较长的停机时间。由于硬件强制限制，预复制与后复制等现代实时迁移方法无法适用于基于TEE的应用。我们提出ConstMig，一种面向大内存占用的基于TEE应用的近零停机实时迁移机制。ConstMig完全兼容容器、虚拟机（VM）及微虚拟机（microVM）。我们在Intel SGX上构建的原型系统，无论安全飞地（enclave）规模大小均可实现近零停机，且无需额外硬件支持。相较于MigSGX等最先进的基于TEE的迁移方案，ConstMig针对多个具有千兆字节级内存占用的SGX应用套件，将总停机时间降低了77%至96%。