T-SGX: Eradicating Controlled-Channel Attacks Against Enclave Programs

Abstract

Intel Software Guard Extensions (SGX) is a hardware-based Trusted Execution Environment (TEE) that enables secure execution of a program in an isolated environment, called an enclave. SGX hardware protects the running enclave against malicious software, including the operating system, hypervisor, and even low-level firmware. This strong security property allows trustworthy execution of programs in hostile environments, such as a public cloud, without trusting anyone (e.g., a cloud provider) between the enclave and the SGX hardware. However, recent studies have demonstrated that enclave programs are vulnerable to accurate controlled-channel attacks conducted by a malicious OS. Since enclaves rely on the underlying OS, curious and potentially malicious OSs can observe a sequence of accessed addresses by intentionally triggering page faults. In this paper, we propose T-SGX, a complete mitigation solution to the controlled-channel attack in terms of compatibility, performance, and ease of use. T-SGX relies on a commodity component of the Intel processor (since Haswell), called Transactional Synchronization Extensions (TSX), which implements a restricted form of hardware transactional memory. As TSX is implemented as an extension (i.e., snooping the cache protocol), any unusual event, such as an exception or interrupt, that should be handled in its core component, results in an abort of the ongoing transaction. One interesting property is that the TSX abort suppresses the notification of errors to the underlying OS. This means that the OS cannot know whether a page fault has occurred during the transaction. T-SGX, by utilizing this property of TSX, can carefully isolate the effect of attempts to tap running enclaves, thereby completely eradicating the known controlledchannel attack. We have implemented T-SGX as a compiler-level scheme to automatically transform a normal enclave program into a secured enclave program without requiring manual source code modification or annotation. We not only evaluate the security properties of T-SGX, but also demonstrate that it could be applied to all the previously demonstrated attack targets, such as libjpeg, Hunspell, and FreeType. To evaluate the performance of T-SGX, we ported 10 benchmark programs of nbench to the SGX environment. Our evaluation results look promising. T-SGX is † The two lead authors contributed equally to this work. ⋆ The author did part of this work during an intership at Microsoft Research. an order of magnitude faster than the state-of-the-art mitigation schemes. On our benchmarks, T-SGX incurs on average 50% performance overhead and less than 30% storage overhead. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper ...

Scanclave: Verifying Application Runtime Integrity in Untrusted Environments

“…To avoid an adversary finding out the moment of the verification, it is important not to leak any information of the enclave's behavior, such as memory or cache access patterns. Previous work covers how software can protect itself against such leakage [6], [12], [32], [34], [35].…”

Trustee: Full Privacy Preserving Vickrey Auction on Top of Ethereum

“…We acknowledge that several recent studies have uncovered side-channel attacks to compromise the confidentiality of Intel SGX [13,19,23,28,29,31]. Also, multiple mitigation techniques have been proposed to address attack-specific issues [18,[24][25][26]. Resolving side-channel attacks on Intel SGX enclave is beyond the scope of this paper and is left for future work.…”

Occlum

“…Side-channel attacks have been shown to be a real threat, especially to Intel SGX [22,25,58]. This field is moving fast: new attacks have been kept being proposed, so have new defenses [45,51]. We believe eventually these efforts that are independent from ours will be able to provide adequent defense against side-channel attacks.…”