Trusted Execution Environments (TEEs) enable applications to obtain strong confidentiality and integrity guarantees even in the presence of privileged but malicious software. Key to their enforcement is an enclave—a secure hardware container that provides isolated execution. However, in order to build enclave-based applications, developers have to carefully partition their application. The process can be tedious and error prone.

In this work, we propose automatic inference of enclave placement in the LLVM compilation framework. Our enclave inference algorithm takes a non-enclave application along with a security policy; infers the enclave placement and compiles it to Intel SGX enclaves using OpenEnclave framework. By implementing at the level of LLVM IR, any application that gets compiled to LLVM IR can leverage our technique significantly reducing the programmer’s burden.