Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX

By Wenhao Wang, Guoxing Chen, Xiaorui Pan, Yinqian Zhang, Xiaofeng Wang, Vincent Bindschaedler, Haixu Tang, Carl A. Gunter. 2017

411 citations recorded by the source corpus.

Side-channel risks of Intel SGX have recently attracted great attention. Under the spotlight is the newly discovered page-fault attack, in which an OS-level adversary induces page faults to observe the page-level access patterns of a protected process running in an SGX enclave. With almost all proposed defense focusing on this attack, little is known about whether such efforts indeed raise the bar for the adversary, whether a simple variation of the attack renders all protection ineffective, not to mention an in-depth understanding of other attack surfaces in the SGX system. In the paper, we report the first step toward systematic analyses of side-channel threats that SGX faces, focusing on the risks associated with its memory management. Our research identifies 8 potential attack vectors, ranging from TLB to DRAM modules. More importantly, we highlight the common misunderstandings about SGX memory side channels, demonstrating that high frequent AEXs can be avoided when recovering EdDSA secret key through a new page channel and fine-grained monitoring of enclave programs (at the level of 64B) can be done through combining both cache and cross-enclave DRAM channels. Our findings reveal the gap between the ongoing security research on SGX and its side-channel weaknesses, redefine the side-channel threat model for secure enclaves, and can provoke a discussion on when to use such a system and how to use it securely.

Subfields: Artificial Intelligence, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Signal Processing

Citations in the corpus

Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts (2018, neutral): “Although trusted hardware aims to protect confidentiality for TEE, recent work has uncovered data leakage via side-channel attacks [18, 38, 40, 46, 53, 54, 66, 70, 79, 91, 93].”
Occlumency: Privacy-preserving Remote Deep-learning Inference Using SGX (2019, background): “Prior studies suggested various sidechannel attacks to SGX applications (on memory management [75], and CPU cache [22, 30, 33]) although SGX provides strong confidentiality and integrity of codes and data.”
Chiron: Privacy-preserving Machine Learning as a Service (2018, background): “As discussed in § 6, side channels can subvert the protections provided by SGX. Side channels based on page faults [64, 65] enable the platform to extract private data by observing page-granularity memory accesses.”
Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures (2018, background): “Recent works also target application fingerprinting [28, 42, 48, 50, 73] to steal web content or server data, monitor user behavior [22, 36, 46, 71], and break system protection mechanisms such as SGX and KASLR [11, 21, 61].”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, background): “However, several software attacks have been demonstrated in numerous papers [18, 37, 7].”
DarkneTZ: towards model privacy at the edge using trusted execution environments (2020, methodology): “EE.TheTEEisdesignedtoconcealthissensitive information (e.g., both CPU time and memory usage); otherwise, the confidentiality of TEE contents would be easily breached by utilizing side-channel attacks [53]. To overcome this, we trigger an abort from the TEE after the process runs stably (memory usage”
Another Flip in the Wall of Rowhammer Defenses (2017, background): “[69] systematically analyzed side-channel threats of SGX and identified 8 potential side-channel attack vectors.”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, background): “s. Although it has already been demonstrated that by observing execution traces of an enclave program left in the CPU caches [58, 13, 27, 25], branch target buffers [42], DRAM’s row buffer contention [75], page-table entries [72, 75], and pagefault exception handlers [80, 62], a side-channel adversa”
Translation Leak-aside Buffer: Defeating Cache Side-channel Protections with TLB Attacks (2018, background): “In particular, Wang et al. [56] showed that it is possible to bypass existing defenses [51] against controlled channel attacks [58] by ﬂushing the TLB to force page table walks without trapping SGX enclaves.”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “s. Although it has already been demonstrated that by observing execution traces of an enclave program left in the CPU caches [58, 13, 27, 25], branch target buffers [42], DRAM’s row buffer contention [75], page-table entries [72, 75], and pagefault exception handlers [80, 62], a side-channel adversa”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, background): “While some types of side channel attacks have been performed on SGX, Intel has been able to fix many of these attacks [14, 12, 15, 16, 17, 18, 12].”
Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution (2017, background): “In this respect, note that concurrent, unpublished work [46] has demonstrated that Intel’s HyperThreading technology can be abused to”