Asylo is an open and flexible framework for developing enclave applications. Asylo lets you take advantage of a range of emerging trusted execution environments (TEEs), including both software and hardware isolation technologies.

Asylo provides:

• The ability to execute trusted workloads in an untrusted environment, inheriting the confidentiality and integrity guarantees from the security backend, i.e., the underlying enclave technology.
• Ready-to-use containers, an open source API, libraries, and tools so you can develop and run applications that use one or more enclaves.
• A choice of security backends.
• Portability of your application's source code across security backends.

Asylo is under active development. We want to expand Asylo's capabilities to meet more developers' needs. To do this, we plan to add support for more backends, libraries, and languages.

The Asylo project documentation can be found at asylo.dev.

Example source code that contains a working Bazel workspace can be downloaded from the Asylo website and used as a template for a new project.

There are several ways of getting support with Asylo:

• Join the asylo-users mailing list to participate in discussions and get help troubleshooting problems.
• Ask questions and find curated answers on Stack Overflow using the asylo tag.

Asylo provides a custom Docker image that contains all required dependencies, as well as Asylo's custom toolchain, which is required for compiling enclave applications for various enclave backends.

docker run -it --rm gcr.io/asylo-framework/asylo

See the Dockerfile for an in-depth view of what's inside the container image.

See this guide for additional details on how to pull images from Google's Container Registry.

Some of Asylo's tests require IPv6 to be enabled in your Docker daemon. See this guide for how to enable IPv6.

Note: If the Docker daemon fails to start with "ipv6": true added to the daemon.json file, you may also need to explicitly configure IPv6 subnet as shown here.

To run the hello_world example, first use the following set of commands to grab the examples source code, and save it to any directory of your choice.

MY_PROJECT=~/asylo-examples
mkdir -p "${MY_PROJECT}"
wget -q -O - https://github.com/google/asylo-examples/archive/master.tar.gz | \
    tar -zxv --strip 1 --directory "${MY_PROJECT}"

Next, use Docker to build and run the hello_world application, using a simulated enclave backend.

NAMES="${USER}"
docker run -it --rm \
    -v bazel-cache:/root/.cache/bazel \
    -v "${MY_PROJECT}":/opt/my-project \
    -w /opt/my-project \
    gcr.io/asylo-framework/asylo \
    bazel run --config=sgx-sim //hello_world -- --names="${NAMES}"

You can also set NAMES to a comma-separated list of names and see the enclave's entry-point get invoked for each name.

In the above example, we use the following Docker flags:

• -it is used to allocate an interactive terminal in which the command is run.
• --rm is used to automatically delete the temporary container after the command completes so that unnecessary images don't persist on disk.
• -v is used to map local files to paths inside the container.
  • The example project files are mapped to /opt/my-project.
  • The local Bazel cache is mapped to /root/.cache/bazel, enabling incremental builds between bazel invocations.
• -w is used to set the working directory in the container so that bazel run command is executed in the example project.

If using the Intel SGX hardware backend (see the Manual Installation guide), the following Docker flags are needed to propagate the necessary capabilities from the host:

• --device=/dev/isgx gives the container access to the SGX device that is used to interact with the SGX hardware features.
• -v /var/run/aesmd/aesm.socket:/var/run/aesmd/aesm.socket allows the container to access the Architectural Enclave Service Manager (AESM) daemon running on the host.

In the above example, we use the following Bazel flags:

• --config=CONFIG configures the Asylo toolchain to build the target for a given enclave backend. You can specify --config=sgx-sim to build the enclave for the Intel SGX simulation backend or --config=sgx to build the enclave for the Intel SGX hardware backend.
• --names="${NAMES}" is the argument passed to the //hello_world target.

Note: The example source code includes an additional Bazel configuration file, .bazelrc, at the root of the source tree. Remember to copy the contents of this file into the .bazelrc file at the root of any future Bazel workspaces that use Asylo's toolchain.

You can follow the steps above to build your own enclave application instead. You can use the examples code in MY_PROJECT as a template for a new project, or simply change MY_PROJECT to point to your own Bazel project instead.

You can get an interactive terminal (instead of running a single command) by omitting the bazel run ... part of the docker invocation. For instance, to run the hello_world example as above but in an interactive terminal, run:

docker run -it --rm \
    -v bazel-cache:/root/.cache/bazel \
    -v "${MY_PROJECT}":/opt/my-project \
    -w /opt/my-project \
    gcr.io/asylo-framework/asylo

This opens a terminal inside the Docker container. From this terminal, you can run Bazel as usual:

bazel run --config=sgx-sim //hello_world -- --names="${NAMES}"

To run our regression test suite, first clone the Asylo repository to a directory of your choice.

ASYLO_SDK=~/asylo-sdk
git clone https://github.com/google/asylo.git "${ASYLO_SDK}"

The regression test suite includes tests that unit-test code directly as well as tests that run inside a simulated enclave environment. You can run it with the following command:

docker run -it --rm \
    -v "${ASYLO_SDK}:/opt/asylo/sdk" \
    -v bazel-cache:/root/.cache/bazel \
    -w "/opt/asylo/sdk" \
    gcr.io/asylo-framework/asylo \
    asylo/test/run_enclave_tests.sh

See Docker flags for a breakdown of the flags used in this command. Note that in this command we also use -v to map the Asylo SDK source files to /opt/asylo/sdk.

If you don't want to use the Asylo Docker image, you can manually install Asylo and its dependencies instead.

See INSTALL.md for detailed installation steps.

The following examples assume that the Asylo SDK was installed at ASYLO_SDK, which can be a directory of your choice. For example:

To run the hello_world example, first use the following commands to grab the examples source code and save it to any directory of your choice.

MY_PROJECT=~/asylo-examples
mkdir -p "${MY_PROJECT}"
wget -q -O - https://github.com/google/asylo-examples/archive/master.tar.gz | \
    tar -zxv --strip 1 --directory "${MY_PROJECT}"

Next, use Bazel to build and run the hello_world application, which uses a simulated SGX enclave backend:

cd "${MY_PROJECT}"
NAMES="${USER}"
bazel run --config=sgx-sim //hello_world -- --names="${NAMES}"

Refer to Bazel flags and workspace settings for an explanation of the flags and workspace configuration used in this example.

You can follow the steps above to build your own enclave application instead. You can use the examples code in MY_PROJECT as the start of your own project, or simply change MY_PROJECT to point to your own Bazel project instead.

If you haven't already, use the following commands to clone the Asylo source code repository and copy it to a directory of your choice.

ASYLO_SDK=~/asylo-sdk
git clone https://github.com/google/asylo.git "${ASYLO_SDK}"

The regression test suite includes tests that unit-test code directly as well as tests that run inside a simulated enclave environment. You can run it with the following command:

"${ASYLO_SDK}"/asylo/test/run_enclave_tests.sh

This repository contains source code for the Asylo framework. The 0.3 release of the framework supports C 11 applications and a Bazel build environment.

The following packages contain source code that may be of particular interest to users of the Asylo framework as well as those looking to contribute to Asylo development.

• asylo/
  • crypto/
    • Crypto utilities and wrappers around BoringSSL.
  • distrib/
    • Asylo toolchain and dependencies.
  • examples/
    • Sample applications written with the Asylo framework.
  • grpc/
    • auth/
      • gRPC authentication support.
    • util/
      • Utilities for using gRPC from a trusted application.
  • identity/
    • Identity and attestation support.
  • platform/
    • Implementation of enclave platforms and backends.
  • test/
    • Testing utilities provided to application writers.
  • util/
    • Common utilities provided for use both inside and outside an enclave environment.

Asylo is released under the Apache 2.0 license.

Copyright 2018 Asylo authors

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

This is not an officially supported Google product.

Asylo's support for various enclave backend technologies does not constitute an endorsement of those technologies or the security properties therein. Users of Asylo should perform due diligence in evaluating whether a backend technology meets the security requirements of their application. Users are advised to use defense-in-depth measures to protect their sensitive applications.