Enclave deployments often fail to simultaneously be secure (e.g., resistant to side channel attacks), powerful (i.e., as fast as an off-the-shelf server), and flexible (i.e., unconstrained by development hurdles). In this paper, we present nitriding, an open tool kit that enables the development of enclave applications that satisfy all three properties. We build nitriding on top of the recently-proposed AWS Nitro Enclaves whose architecture prevents side channel attacks by design, making nitriding more secure than comparable frameworks. We abstract away the constrained development model of Nitro Enclaves, making it possible to run unmodified applications inside an enclave that have seamless and secure Internet connectivity, all while making our code user-verifiable. To demonstrate nitriding's flexibility, we design three enclave applications, each a research contribution in its own right: (i) we run a Tor bridge inside an enclave, making it resistant to protocol-level deanonymization attacks; (ii) we built a service for securely revealing infrastructure configuration, empowering users to verify privacy promises like the discarding of IP addresses at the edge; (iii) and we move a Chromium browser into an enclave, thereby isolating its attack surface from the user's system. We find that nitriding enables rapid prototyping and alleviates the deployment of production-quality systems, paving the way toward usable and secure enclaves.

翻译：飞地部署往往难以同时实现安全性（例如，抵抗侧信道攻击）、强大性（即，与现成服务器一样快）和灵活性（即，不受开发限制）。本文提出氮化（nitriding）——一个开源工具套件，支持开发同时满足这三项属性的飞地应用。我们基于近期提出的AWS Nitro Enclaves构建氮化,其架构通过设计防止侧信道攻击，使氮化比同类框架更安全。我们抽象了Nitro Enclaves受限的开发模型，使得在飞地内运行未经修改的应用成为可能，并具备无缝安全的互联网连接，同时保持代码可被用户验证。为展示氮化的灵活性，我们设计了三个飞地应用，每个本身即为独立的研究贡献：（i）在飞地内运行Tor桥接器，使其能抵抗协议级的去匿名化攻击；（ii）构建用于安全揭示基础设施配置的服务，使用户能够验证隐私承诺（如边缘端丢弃IP地址）；（iii）将Chromium浏览器迁移至飞地内，从而将其攻击面与用户系统隔离。我们发现氮化支持快速原型开发，简化了生产级系统的部署，为构建可用且安全的飞地铺平道路。