一句话：提出 Occlum，使 Intel SGX 上的库操作系统能够安全且高效地支持多任务。
Intel SGX 允许用户级代码创建受 CPU 保护的私有内存区域 enclave，使其代码和数据免受 enclave 外的软硬件攻击。近期工作引入库操作系统（LibOS），让遗留应用几乎无需修改即可运行在 enclave 内。然而，几乎所有非平凡应用都需要多进程支持，因此 LibOS 必须支持多任务；但现有 SGX LibOS 均未能同时安全且高效地支持多任务。Occlum 针对这一问题，旨在为 SGX 环境提供安全、高效的多任务 LibOS 支持。摘要未给出具体实现机制与量化评估结果。
Intel Software Guard Extensions (SGX) enables user-level code to create private memory regions called enclaves, whose code and data are protected by the CPU from software and hardware attacks outside the enclaves. Recent work introduces library operating systems (LibOSes) to SGX so that legacy applications can run inside enclaves with few or even no modifications. As virtually any non-trivial application demands multiple processes, it is essential for LibOSes to support multitasking. However, none of the existing SGX LibOSes support multitasking both securely and efficiently.