Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution

By Jo Van Bulck, Nico Weichbrodt, Rüdiger Kapitza, Frank Piessens, Raoul Strackx. 2017

328 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, background): “In the past years, many attacks have been proposed, with the goal of undermining privacy of enclave computations (Xu et al., 2015; Brasser et al., 2017; Moghimi et al., 2017; Götzfried et al., 2017; Van Bulck et al., 2017; Lee et al., 2017).”
Prochlo: Strong Privacy for Analytics in the Crowd (2017, methodology): “We also took care to minimize side channels [12, 43, 76]; for example, we ensure that control paths involving real and dummy items are the same, and write the same private memory pages.”
Foreshadow: Extracting the Keys to the Intel SGX Kingdom with Transient Out-of-Order Execution (2018, unknown): “However, as enclaved execution also abides by page table-based access restrictions [58, 60], these privi-”
Keystone: an open framework for architecting trusted execution environments (2020, background): “We point out that Keystone is not vulnerable to a large class of side-channel attacks [28, 90] by design, while speculative execution attacks [27, 56] are limited to out-of-order RISC-V cores (e.g., BOOM) and do not affect most SOC implementations (e.g., Rocket).”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, background): “y been demonstrated that by observing execution traces of an enclave program left in the CPU caches [58, 13, 27, 25], branch target buffers [42], DRAM’s row buffer contention [75], page-table entries [72, 75], and pagefault exception handlers [80, 62], a side-channel adversarywithsystemprivilegesmay”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “Many sidechannels attacks exploiting page fault [7, 32, 37], cache timing [6, 13, 16, 30], and branch prediction [24] have been proposed to attack SGX.”
Plundervolt: Software-based Fault Injection Attacks against Intel SGX (2020, background): “While there is a long line of work on dismantling SGX’s conﬁdentiality guarantees [69, 11, 46, 73, 50, 25, 72] as well as exploiting classical memory safety vulnerabilities in enclaves [45, 8, 70], Plundervolt represents the ﬁrst attack that directly violates SGX’s integrity guarantees for…”
PROCHLO: Strong Privacy for Analytics in the Crowd (2017, methodology): “We also took care to minimize side channels [12, 43, 76]; for example, we ensure that control paths involving real and dummy items are the same, and write the same private memory pages.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “Although it has already been demonstrated that by observing execution traces of an enclave program left in the CPU caches [7, 19, 21, 60], branch target buffers [44], DRAM’s row buffer contention [77], page-table entries [74, 77], and page-fault exception”