High-Resolution Side Channels for Untrusted Operating Systems

By Marcus Hähnel, Weidong Cui, Marcus Peinado. 2017

183 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts (2018, positive): “Although trusted hardware aims to protect confidentiality for TEE, recent work has uncovered data leakage via side-channel attacks [18, 38, 40, 46, 53, 54, 66, 70, 79, 91, 93].”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, methodology): “GX. The SgxPectre Attacks are variants of micro-architectural side-channel attacks. Previously, various micro-architectural side-channel attacks have been demonstrated on SGX, which CPU cache attacks [7, 19, 21, 60], BTB attacks [44], page-table attacks [64, 74, 82], cache-DRAM attacks [77], etc. Sg”
BranchScope: A New Side-Channel Attack on Directional Branch Predictor (2018, methodology): “Attacks on libjpeg were previously demonstrated using the page fault side channel [27, 54] by counting the number of times the optimization can be applied, resulting in recovery of an original image.”
Occlumency: Privacy-preserving Remote Deep-learning Inference Using SGX (2019, background): “Prior studies suggested various sidechannel attacks to SGX applications (on memory management [75], and CPU cache [22, 30, 33]) although SGX provides strong confidentiality and integrity of codes and data.”
Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution (2018, unknown): “This point has been repeatedly demonstrated in the form of a steady stream of highresolution PRIME+PROBE CPU cache [6,12,17,23,46,51] and branch prediction [13, 39] attacks against SGX enclaves.”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, methodology): “GX. The SgxPectre Attacks are variants of micro-architectural side-channel attacks. Previously, various micro-architectural side-channel attacks have been demonstrated on SGX, which CPU cache attacks [7, 19, 21, 60], BTB attacks [44], page-table attacks [64, 74, 82], cache-DRAM attacks [77], etc. Sg”
Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing (2016, methodology): “[21] exploit a frequent timer in Windows to realize a precise cache side-channel attack against the Intel SGX simulator.”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, background): “ding data caches (and also per-core L2 unified caches) [19, 21, 32, 34, 35, 40], instruction caches [8, 9, 47], and inclusive LLCs [12, 18, 22, 23, 25, 26, 29, 30, 33, 44–46, 48]. Some recent studies [14, 17, 20, 31] have shown that the above side channels are still feasible on SGX enclaves. We brie”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “Many sidechannels attacks exploiting page fault [7, 32, 37], cache timing [6, 13, 16, 30], and branch prediction [24] have been proposed to attack SGX.”