<p><strong><code>Intel SGX</code> is designed for securing data and not loading the entire application</strong>. You can perform secure computations inside the <code>SGX</code> enclaves on your data by sending temporary buffers from the user space program (<code>app.cpp</code>) to your <code>SGX</code> enclave (<code>Enclave.cpp</code>). But why?</p>

<ol>
<li>The enclave size is small and you can't load all your data inside it at the same time.</li>
<li>Inside enclaves, you're limited to a set of programming primitives like if-then-else, for-loop, and etc. Also, you can't have syscalls like <code>open</code> for opening a file.</li>
</ol>

<p>Thus, if your application is large or contains some syscalls or even some forbidden standard C library functions by <code>SGX</code> implementation, it is impossible to import it entirely inside an enclave. But, if your application is doing some primitive operations without the need for any special syscall or function call, you can freely port it inside an enclave. Still, you can't directly load it inside an enclave you have to change your implementation to make it as a <strong>trusted enclave call</strong> inside the <code>Enclave.cpp</code>.</p>

<p>As an example, I've implemented a set of cryptographic operations e.g. SHA-2, HMAC SHA-2, AES, and etc. inside an enclave. I send/receive temporary buffers of pliantext/ciphertext data to/from enclave performing the encryption/decryption operations inside the enclave and storing the results of computation like a hash digest, or ciphertexts in userspace. In this way, I ensure that no one can tamper the results of operations because they're running inside the enclave which is secured by CPU instructions.</p>

<p>You can read more about this example <a href="https://arxiv.org/abs/1705.04706" rel="nofollow noreferrer">here</a> and check the implementation <a href="https://github.com/hmofrad/CryptoEnclave" rel="nofollow noreferrer">here</a>.</p>
Load an application into Intel SGX enclave
<p>Is there a way to load an existing application into an <code>Intel SGX</code> enclave directly?</p>