eleos sgx
17262518
Eleos: ExitLess OS Services for SGX Enclaves
Intel Software Guard extensions (SGX) enable secure and trusted execution of user code in an isolated enclave to protect against a powerful adversary. Unfortunately, running I/O intensive, memory demanding server applications in enclaves leads to significant performance degradation. Such applications put a substantial load on the in enclave system call and secure paging mechanisms, which turn out to be the main reason for the application slowdown. In addition to the high direct cost of thousands of cycles long SGX management instructions, these mechanisms incur the high indirect cost of enclave exits due to associated TLB flushes and processor state pollution. We tackle these performance issues in Eleos by enabling exit less system calls and exit less paging in enclaves. Eleos introduces a novel Secure User managed Virtual Memory (SUVM) abstraction that implements application level paging inside the enclave. SUVM eliminates the overheads of enclave exits due to paging, and enables new optimizations such as sub page granularity of accesses. We thoroughly evaluate Eleos on a range of microbenchmarks and two real server applications, achieving notable system performance gains. memcached and a face verification server running in enclave with Eleos, achieves up to 2.2x and 2.3x higher throughput respectively while working on datasets up to 5x larger than the enclave's secure physical memory.
EuroSys
Meni Orenbach Pavel Lifshits Marina Minkin Mark Silberstein
209480256
Plundervolt: Software based Fault Injection Attacks against Intel SGX
Dynamic frequency and voltage scaling features have been introduced to manage ever growing heat and power consumption in modern processors. Design restrictions ensure frequency and voltage are adjusted as a pair, based on the current load, because for each frequency there is only a certain voltage range where the processor can operate correctly. For this purpose, many processors (including the widespread Intel Core series) expose privileged software interfaces to dynamically regulate processor frequency and operating voltage.In this paper, we demonstrate that these privileged interfaces can be reliably exploited to undermine the system's security. We present the Plundervolt attack, in which a privileged software adversary abuses an undocumented Intel Core voltage scaling interface to corrupt the integrity of Intel SGX enclave computations. Plundervolt carefully controls the processor's supply voltage during an enclave computation, inducing predictable faults within the processor package. Consequently, even Intel SGX's memory encryption/authentication technology cannot protect against Plundervolt. In multiple case studies, we show how the induced faults in enclave computations can be leveraged in real world attacks to recover keys from cryptographic algorithms (including the AES NI instruction set extension) or to induce memory safety vulnerabilities into bug free enclave code. We finally discuss why mitigating Plundervolt is not trivial, requiring trusted computing base recovery through microcode updates or hardware changes.
2020 IEEE Symposium on Security and Privacy (SP)
Kit Murdock David Oswald Flavio D Garcia Jo Van Bulck Daniel Gruss Frank Piessens
210839240
Occlum: Secure and Efficient Multitasking Inside a Single Enclave of Intel SGX
Intel Software Guard Extensions (SGX) enables user level code to create private memory regions called enclaves, whose code and data are protected by the CPU from software and hardware attacks outside the enclaves. Recent work introduces library operating systems (LibOSes) to SGX so that legacy applications can run inside enclaves with few or even no modifications. As virtually any non trivial application demands multiple processes, it is essential for LibOSes to support multitasking. However, none of the existing SGX LibOSes support multitasking both securely and efficiently. This paper presents Occlum, a system that enables secure and efficient multitasking on SGX. We implement the LibOS processes as SFI Isolated Processes (SIPs) SFI is a software instrumentation technique for sandboxing untrusted modules (called domains) We design a novel SFI scheme named MPX based, Multi Domain SFI (MMDSFI) and leverage MMDSFI to enforce the isolation of SIPs. We also design an independent verifier to ensure the security guarantees of MMDSFI. With SIPs safely sharing the single address space of an enclave, the LibOS can implement multitasking efficiently. The Occlum LibOS outperforms the state of the art SGX LibOS on multitasking heavy workloads by up to 6,600x on micro benchmarks and up to 500x on application benchmarks.
ASPLOS
Youren Shen Hongliang Tian Yu Chen Kang Chen Runji Wang Yi Xu Yubin Xia
52036294
Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out of Order Execution
Trusted execution environments, and particularly the Software Guard eXtensions (SGX) included in recent Intel x86 processors, gained significant traction in recent years. A long track of research papers, and increasingly also real world industry applications, take advantage of the strong hardware enforced confidentiality and integrity guarantees provided by Intel SGX. Ultimately, enclaved execution holds the compelling potential of securely offloading sensitive computations to untrusted remote platforms. We present Foreshadow, a practical software only microarchitectural attack that decisively dismantles the security objectives of current SGX implementations. Crucially, unlike previous SGX attacks, we do not make any assumptions on the victim enclave's code and do not necessarily require kernel level access. At its core, Foreshadow abuses a speculative execution bug in modern Intel processors, on top of which we develop a novel exploitation methodology to reliably leak plaintext enclave secrets from the CPU cache. We demonstrate our attacks by extracting full cryptographic keys from Intel's vetted architectural enclaves, and validate their correctness by launching rogue production enclaves and forging arbitrary local and remote attestation responses. The extracted remote attestation keys affect millions of devices.
USENIX Security Symposium
Jo Van Bulck Marina Minkin Ofir Weisse Daniel Genkin Baris Kasikci Frank Piessens Mark Silberstein Thomas F Wenisch Yuval Yarom Raoul Strackx
46926456
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution
Speculative execution side channel vulnerabilities in micro architecture processors have raised concerns about the security of Intel SGX. To understand clearly the security impact of this vulnerability against SGX, this paper makes the following studies: First, to demonstrate the feasibility of the attacks, we present SgxPectre Attacks (the SGX variants of Spectre attacks) that exploit speculative execution side channel vulnerabilities to subvert the confidentiality of SGX enclaves. We show that when the branch prediction of the enclave code can be influenced by programs outside the enclave, the control flow of the enclave program can be temporarily altered to execute instructions that lead to observable cache state changes. An adversary observing such changes can learn secrets inside the enclave memory or its internal registers, thus completely defeating the confidentiality guarantee offered by SGX. Second, to determine whether real world enclave programs are impacted by the attacks, we develop techniques to automate the search of vulnerable code patterns in enclave binaries using symbolic execution. Our study suggests that nearly any enclave program could be vulnerable to SgxPectre Attacks since vulnerable code patterns are available in most SGX runtimes (e.g. Intel SGX SDK, Rust SGX, and Graphene SGX) Third, we apply SgxPectre Attacks to steal seal keys and attestation keys from Intel signed quoting enclaves. The seal key can be used to decrypt sealed storage outside the enclaves and forge valid sealed data; the attestation key can be used to forge attestation signatures. For these reasons, SgxPectre Attacks practically defeat SGX's security protection. Finally, we evaluate Intel's existing countermeasures against SgxPectre Attacks and discusses the security implications.
2019 IEEE European Symposium on Security and Privacy (EuroS&P)
Guoxing Chen Sanchuan Chen Yuan Xiao Yinqian Zhang Zhiqiang Lin Ten-Hwang Lai
219645936
A Survey of Published Attacks on Intel SGX
Intel Software Guard Extensions \kw{SGX} provides a trusted execution environment \kw{TEE} to run code and operate sensitive data.\kw{SGX} provides runtime hardware protection where both code and data are protected even if other code components are malicious.However, recently many attacks targeting \kw{SGX} have been identified and introduced that can thwart the hardware defence provided by \kw{SGX}.In this paper we present a survey of all attacks specifically targeting Intel \kw{SGX} that are known to the authors, to date.We categorized the attacks based on their implementation details into 7 different categories.We also look into the available defence mechanisms against identified attacks and categorize the available types of mitigations for each presented attack. (Less)
ArXiv
Alexander Nilsson Pegah Nikbakht Bideh Joakim Brorsson
212687858
COIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX
Intel SGX is a hardware based trusted execution environment (TEE) which enables an application to compute on confidential data in a secure enclave. SGX assumes a powerful threat model, in which only the CPU itself is trusted; anything else is untrusted, including the memory, firmware, system software, etc. An enclave interacts with its host application through an exposed, enclave specific, (usually) bi directional interface. This interface is the main attack surface of the enclave. The attacker can invoke the interface in any order and inputs. It is thus imperative to secure it through careful design and defensive programming. In this work, we systematically analyze the attack models against the enclave untrusted interfaces and summarized them into the COIN attacks Concurrent, Order, Inputs, and Nested. Together, these four models allow the attacker to invoke the enclave interface in any order with arbitrary inputs, including from multiple threads. We then build an extensible framework to test an enclave in the presence of COIN attacks with instruction emulation and concolic execution. We evaluated ten popular open source SGX projects using eight vulnerability detection policies that cover information leaks, control flow hijackings, and memory vulnerabilities. We found 52 vulnerabilities. In one case, we discovered an information leak that could reliably dump the entire enclave memory by manipulating the inputs. Our evaluation highlights the necessity of extensively testing an enclave before its deployment.
ASPLOS
Mustakimur Rahman Khandaker Yueqiang Cheng Zhi Wang Tao Wei
208541009
Bluethunder: A 2 level Directional Predictor Based Side Channel Attack against SGX
Software Guard Extension (SGX) is a hardware based trusted execution environment (TEE) implemented in recent Intel commodity processors. By isolating the memory of security critical applications from untrusted software, this mechanism provides users with a strongly shielded environment called enclave for executing programs safely. However, recent studies have demonstrated that SGX enclaves are vulnerable to side channel attacks. In order to deal with these attacks, several protection techniques have been studied and utilized.In this paper, we explore a new pattern history table (PHT) based side channel attack against SGX named Bluethunder, which can bypass existing protection techniques and reveal the secret information inside an enclave. Comparing to existing PHT based attacks (such as Branchscope [ERAG+18] Bluethunder abuses the 2 level directional predictor in the branch prediction unit, on top of which we develop an exploitation methodology to disclose the input dependent control flow in an enclave. Since the cost of training the 2 level predictor is pretty low, Bluethunder can achieve a high bandwidth during the attack. We evaluate our attacks on two case studies: extracting the format string information in the vfprintf function in the Intel SGX SDK and attacking the implementation of RSA decryption algorithm in mbed TLS. Both attacks show that Bluethunder can recover fine grained information inside an enclave with low training overhead, which outperforms the latest PHT based side channel attack (Branchscope) by 52x. Specifically, in the second attack, Bluethunder can recover the RSA private key with 96.76% accuracy in a single run.
IACR Trans. Cryptogr. Hardw. Embed. Syst.
Tianlin Huo Xiaoni Meng Wenhao Wang Chunliang Hao Pei Zhao Jian Zhai Mingshu Li
60440544
Practical Enclave Malware with Intel SGX
Modern CPU architectures offer strong isolation guarantees towards user applications in the form of enclaves. However, Intel's threat model for SGX assumes fully trusted enclaves and there doubt about how realistic this is. In particular, it is unclear to what extent enclave malware could harm a system. In this work, we practically demonstrate the first enclave malware which fully and stealthily impersonates its host application. Together with poorly deployed application isolation on personal computers, such malware can not only steal or encrypt documents for extortion but also act on the user's behalf, e.g. send phishing emails or mount denial of service attacks. Our SGX ROP attack uses new TSX based memory disclosure primitive and a write anything anywhere primitive to construct a code reuse attack from within an enclave which is then inadvertently executed by the host application. With SGX ROP, we bypass ASLR, stack canaries, and address sanitizer. We demonstrate that instead of protecting users from harm, SGX currently poses a security threat, facilitating so called super malware with ready to hit exploits. With our results, we demystify the enclave malware threat and lay ground for future research on defenses against enclave malware.
DIMVA
Michael Schwarz Samuel Weiser Daniel Gruss
213982560
SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution
The speculative execution of side channel vulnerabilities in microarchitecture processors has raised concerns about the security of Intel's Software Guard eXtensions (SGX) We present SgxPectre attacks, the SGX variants of Spectre attacks, which exploit speculative execution vulnerabilities to subvert the confidentiality of SGX enclaves; evaluate Intel's existing countermeasures against SgxPectre attacks; and discuss security implications.
IEEE Security Privacy
Guoxing Chen Sanchuan Chen Yuan Xiao Yinqian Zhang Zhiqiang Lin Ten-Hwang Lai