July 12, 2026 • 12 min read
Intel SGX Memory Swapping: Analyzing Real Enclave Page Cache (EPC) Benchmarks
Deploying data-heavy operations inside Trusted Execution Environments (TEEs) requires balancing cryptographic security against system memory bounds. During my research internship at NJIT, I profiled our secure C++ document processing backend on Azure DCsv2 VMs to analyze the performance overhead of Enclave Page Cache (EPC) swapping.
Below is the empirical analysis extracted from our raw experimental logs (audit_pull_log.json), documenting runtimes across file payloads from 19.07 MB up to 2.86 GB.
1. Experimental Parameters & Raw Log Observations
We evaluated performance runs by tuning the batch processing buffers (adjusting the number of chunks processed inside the enclave per call) to measure heap utilization (total_sgx_potential_used) against total elapsed times.
| File Size | SGX Mem Footprint | Decrypt Time | Search Time | Total Elapsed |
|---|---|---|---|---|
| 19.07 MB | 13.35 MB | 11.71 ms | 35.81 ms | 72.81 ms |
| 95.37 MB | 13.35 MB | 56.92 ms | 254.91 ms | 416.53 ms |
| 95.37 MB | 125.88 MB | 422.57 ms | 209.84 ms | 1053.85 ms |
| 953.70 MB | 29.56 MB | 584.31 ms | 2432.77 ms | 4132.91 ms |
| 953.70 MB | 62.94 MB | 4492.79 ms | 2496.45 ms | 11427.01 ms |
| 2.86 GB | 13.35 MB | 1725.47 ms | 7543.89 ms | 12532.57 ms |
| 2.86 GB | 29.56 MB | 1735.60 ms | 7611.60 ms | 74730.53 ms |
2. Key Insights: Identifying the Memory Swapping Threshold
An analysis of the logs yields two critical systems observations:
A. The Decryption Swapping Jump
For the 953.70 MB run, when memory utilization increases from 29.56 MB to 62.94 MB, total elapsed execution time spikes from 4.13 seconds to 11.42 seconds. This 2.7x performance hit is driven almost entirely by the decryption phase, which ballooned from 584.31 ms to 4492.79 ms. Because the decryption buffers exceeded active cache bounds, the CPU spent the majority of its cycles executing encrypted swapping operations out to untrusted DRAM.
B. The 2.86 GB Execution Collapse
On the 2.86 GB file runs, we observed a massive collapse when the batch configurations changed:
- Run 1 (13.35 MB footprint): Executed successfully in 12.53 seconds because the active cache footprints stayed well below swapping thresholds.
- Run 2 (29.56 MB footprint): Elapsed time skyrocketed to 74.73 seconds, a 5.9x slowdown driven by constant page swapping overhead.
3. Architectural Recommendations
To prevent this performance degradation, document processing enclaves must dynamically adjust buffer sizes:
Dynamic Batch Sizing: Programmatically limit enclave heap utilization to stay below 40MB inside standard Intel SGX 1.0 enclaves.
JNI Optimization: Batch primitive data structures across JNI boundaries to minimize transitions, reducing register scrubbing and TLB flush frequencies.