How to manage Intel SGX on a dedicated server

Objective

Enabling Intel Software Guard Extensions (SGX) on your server allows you to run SGX-ready applications. Intel SGX provides advanced hardware and RAM security encryption features, in order to isolate specific parts of code and data for each application.

This guide explains how to enable the SGX feature, via the OVHcloud Control Panel or via the OVHcloud API.

Requirements

• Access to the OVHcloud API (optional)
• A dedicated server compatible with the SGX option in your OVHcloud account
• The credentials received by email after installation
• Ubuntu 24.04 or equivalent is installed on the server

OVHcloud Control Panel Access

• Direct link: Dedicated Servers
• Navigation path: Bare Metal Cloud > Dedicated servers > Select your server

Instructions

Enabling SGX

The activation of SGX is possible from the OVHcloud Control Panel, the OVHcloud API, or your server's BIOS.

Installing the SGX software stack

Use the following commands to install the Intel SDK in order to develop and run SGX applications.

First, install some dependencies:

sudo apt update
sudo apt install autoconf automake build-Essential cmake debhelper git libcurl4-openssl-dev libprotobuf-dev libssl-dev libtool lsb-release ocaml ocamlbuild protobuf-compiler python-is-python3 reprepro wget perl unzip pkgconf libboost-dev libboost-system-dev libboost-thread-dev libsystemd0

Next, download the source code and prepare the submodules and prebuilt binaries:

BASE_DIR=/opt/intel
[[ -d $BASE_DIR ]] || sudo mkdir -p $BASE_DIR && sudo chown `whoami` $BASE_DIR
cd $BASE_DIR

git clone https://github.com/intel/linux-sgx.git

cd linux-sgx
git checkout sgx_2.26
make preparation

Build and install the SGX SDK:

make sdk_install_pkg
$ ./linux/installer/bin/sgx_linux_x64_sdk_2.26.100.0.bin --prefix=$BASE_DIR/

Test the sample application in simulation mode

To build and run the LocalAttestation sample code in simulation mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=SIM make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

Build and install the Intel SGX PSW

The Intel SGX Platform Software (PSW) provides software libraries to run SGX applications in hardware mode. To create the local Debian repository that hosts the packages, run the following commands:

BASE_DIR=/opt/intel
cd $BASE_DIR/linux-sgx
make deb_local_repo

Create the following file to add the local Debian package repository to the repository configuration system:

$ cat /etc/apt/sources.list.d/sgx.sources
Types: deb
URIs: file:/opt/intel/linux-sgx/linux/installer/deb/sgx_debian_local_repo
Suites: noble
Components: main
trusted: yes

Then, install the following packages:

sudo apt update
sudo apt-get install libsgx-epid libsgx-quote-ex libsgx-dcap-ql

Test the sample application in hardware mode (optional)

To build and run the LocalAttestation sample code in hardware mode:

BASE_DIR=/opt/intel
cd $BASE_DIR/sgxsdk/SampleCode/LocalAttestation/
source $BASE_DIR/sgxsdk/environment

make clean
SGX_MODE=HW make
cd bin
sudo ./app
succeed to load enclaves.
succeed to establish secure channel.
Succeed to exchange secure message...
Succeed to close Session...

Go further

To go further (develop your own application, register for remote attestation, etc.), here are some useful resources:

• Intel SGX
• Intel SGX Attestation services
• Intel SGX linux-2.26 documentation
• github.com/intel/linux-sgx