Novel confidential computing technologies such as Intel TDX, AMD SEV, and Arm CCA have recently emerged. In practice, due to its minimal trust boundaries, Intel SGX still remains widely used for enclave-based applications in cloud environments, including confidential cloud services, privacy-preserving communication, secure payment processing, and privacy-focused advertising. With the growing adoption of Arm CPUs in cloud systems, however, existing SGX applications face a significant portability challenge: they are tightly coupled to SGX-specific APIs and execution semantics. In this paper, we present the design and implementation of CCX, a framework that enables existing SGX applications to run on Arm CCA without source code modification. To this end, CCX redesigns SGX functionality within Arm CCA firmware, adapting SGX abstractions to CCA's architecture design while preserving full compatibility with existing applications originally developed for SGX. We implemented a prototype of CCX on both the QEMU emulator and a Nitrogen8M development board. Our evaluation shows that CCX is capable of executing existing SGX applications without requiring source code changes, while providing security guarantees comparable to Intel SGX and achieving performance improvements in our evaluated settings.

翻译：近年来，出现了诸如Intel TDX、AMD SEV和Arm CCA等新型机密计算技术。实践中，由于其最小的信任边界，Intel SGX在云环境中仍广泛应用于基于飞地的应用程序，包括机密云服务、隐私保护通信、安全支付处理和隐私聚焦广告。然而，随着Arm CPU在云系统中的日益普及，现有SGX应用程序面临严峻的可移植性挑战：它们与SGX特定的API和执行语义紧密耦合。本文介绍了CCX的设计与实现，该框架使现有SGX应用程序能够在Arm CCA上无需修改源代码即可运行。为此，CCX在Arm CCA固件内重新设计了SGX功能，将SGX抽象适配至CCA架构设计，同时保持与最初为SGX开发的现有应用程序的完全兼容性。我们在QEMU模拟器和Nitrogen8M开发板上实现了CCX原型。评估表明，CCX能够无需修改源代码即可执行现有SGX应用程序，同时提供与Intel SGX相当的安全保证，并在我们的评估设置中实现了性能提升。