Recent Trusted Execution Environments based on Intel SGXv2 enable fast and confidential in-memory processing for DBMSs. However, secure persistence remains a major performance and security challenge. While native SGX-based storage mechanisms provide confidentiality and integrity out of the box, they incur high overheads for DBMSs. In this paper, we analyze the overheads and introduce novel techniques for secure and fast DBMS storage. As we show, these techniques reduce the high storage overheads of native SGX storage mechanisms to negligible overheads, enabling practical, high-performance, secure storage for cloud databases.

Cloud databases have become prevalent, as evidenced by the rapid growth of systems such as BigQuery, Snowflake, and Databricks.Concurrently, there has been a significant increase in the requirements for secure data processing when outsourcing databases to the cloud.For this, Trusted Execution Environments (TEEs) have emerged as a key technology in the cloud, which is witnessed by the fact that all cloud providers offer TEEs in their service portfolios.However, Amazon Web Services' (AWS) approach to TEEs based on Nitro Enclaves fundamentally differs from that of other cloud providers like Microsoft and Google or standard technologies such as Intel SGX.In this paper, we thus set out the goal to understand the implications of using AWS Nitro Enclaves for cloud databases.Although Nitro Enclaves initially appear to be a promising platform for pure TEE performance, they come with significant limitations regarding communication with the Nitro Enclave.Our benchmark results provide insight into the performance and practical challenges of deploying database workloads in AWS Nitro Enclaves, offering valuable guidance for practitioners and researchers.

In recent years, trusted execution environments (TEEs) such as Intel Software Guard Extensions (SGX) have gained a lot of attention in the database community. This is because TEEs provide an interesting platform for building trusted databases in the cloud. However, until recently SGX was only available on low-end single socket servers built on the Intel Xeon E3 processor generation and came with many restrictions for building DBMSs. With the availability of the new Ice Lake processors, Intel provides a new implementation of the SGX technology that supports high-end multi-socket servers. With this new implementation, which we refer to as SGXv2 in this paper, Intel promises to address several limitations of SGX enclaves. This raises the question whether previous efforts to overcome the limitations of SGX for DBMSs are still applicable and if the new generation of SGX can truly deliver on the promise to secure data without compromising on performance. To answer this question, in this paper we conduct a first systematic performance study of Intel SGXv2 and compare it to the previous generation of SGX.