Graphene is a lightweight library OS, designed to run a single Linux application in an isolated environment. Currently, Graphene runs on Linux and Intel SGX enclaves on Linux platforms. With Intel SGX support, Graphene can secure a critical application in a hardware-encrypted memory region and protect the application from a malicious system stack with minimal porting effort.

This talk will discuss the design, implementation, features, lessons learned, and the current status of the project. The talk will highlight some of the technical challenges of enabling unmodified applications in restricted secure environments such as Intel SGX enclaves.