Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing

By Sangho Lee, Ming-Wei Shih, Prasun Gera, Taesoo Kim, Hyesoon Kim, Marcus Peinado. 2016

548 citations recorded by the source corpus.

Intel has introduced a hardware-based trusted execution environment, Intel Software Guard Extensions (SGX), that provides a secure, isolated execution environment, or enclave, for a user program without trusting any underlying software (e.g., an operating system) or firmware. Researchers have demonstrated that SGX is vulnerable to a page-fault-based attack. However, the attack only reveals page-level memory accesses within an enclave. In this paper, we explore a new, yet critical, side-channel attack, branch shadowing, that reveals fine-grained control flows (branch granularity) in an enclave. The root cause of this attack is that SGX does not clear branch history when switching from enclave to nonenclave mode, leaving fine-grained traces for the outside world to observe, which gives rise to a branch-prediction side channel. However, exploiting this channel in practice is challenging because 1) measuring branch execution time is too noisy for distinguishing fine-grained controlflow changes and 2) pausing an enclave right after it has executed the code block we target requires sophisticated control. To overcome these challenges, we develop two novel exploitation techniques: 1) a last branch record (LBR)-based history-inferring technique and 2) an advanced programmable interrupt controller (APIC)-based technique to control the execution of an enclave in a finegrained manner. An evaluation against RSA shows that our attack infers each private key bit with 99.8% accuracy. Finally, we thoroughly study the feasibility of hardware-based solutions (i.e., branch history flushing) and propose a software-based approach that mitigates the attack.

Subfields: Artificial Intelligence, Hardware and Architecture, Materials Chemistry

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Materials Chemistry

Citations in the corpus

Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware (2018, background): “In the past years, many attacks have been proposed, with the goal of undermining privacy of enclave computations (Xu et al., 2015; Brasser et al., 2017; Moghimi et al., 2017; Götzfried et al., 2017; Van Bulck et al., 2017; Lee et al., 2017).”
Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contracts (2018, neutral): “Although trusted hardware aims to protect confidentiality for TEE, recent work has uncovered data leakage via side-channel attacks [18, 38, 40, 46, 53, 54, 66, 70, 79, 91, 93].”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, background): “And indeed, first proposed works showing that microarchitectural side channels can be exploited include attacks using page table faults [53] and the branch prediction unit [34].”
Leaky Cauldron on the Dark Land: Understanding Memory Side-Channel Hazards in SGX (2017, background): “A very recent study explores branch prediction units as side channels to infer sensitive control flows inside SGX enclaves [25].”
Hacking in Darkness: Return-oriented Programming against Secure Enclaves (2017, background): “Several authors [26, 33, 38] have identified side channels that can leak large amounts of sensitive information out of the application’s isolated execution”
DeepAttest: An End-to-End Attestation Framework for Deep Neural Networks (2019, background): “identified to be vulnerable to side-channel attacks [6, 30].”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, background): “While some types of side channel attacks have been performed on SGX, Intel has been able to fix many of these attacks [14, 12, 15, 16, 17, 18, 12].”
Edge Computing Security: State of the Art and Challenges (2019, background): “[94] exploited the branch history channel of SGX to successfully infer the fine-grained control flow executed in SGX.”
Sanctum: Minimal Hardware Extensions for Strong Software Isolation (2016, background): “Moreover, much like cache timing attacks, indirect observation of other hardware structures [32] may allow an adversary to glean private information without violating memory access protections.”
A Formal Foundation for Secure Remote Execution of Enclaves (2017, background): “Attacks exploiting other shared resources exist as well, such as those observing a core’s branch history buffers [35].”
BranchScope: A New Side-Channel Attack on Directional Branch Predictor (2018, methodology): “Lee et al. [35] built on that work by exploiting the BTB collisions to also discover the direction of the victim’s branch instructions.”
SGX-Bomb: Locking Down the Processor via Rowhammer Attack (2017, background): “Many sidechannels attacks exploiting page fault [7, 32, 37], cache timing [6, 13, 16, 30], and branch prediction [24] have been proposed to attack SGX.”
Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution (2017, methodology): “Finally, between submission and publication of this paper, the SGX research community has witnessed a steady stream of microarchitectural side-channel attacks; either by abusing the branch prediction unit [28], or in the form of finegrained PRIME+PROBE [13, 37, 5, 33] cache attacks.”
Software Grand Exposure: SGX Cache Attacks Are Practical (2017, background): “[33] use branch shadowing to infer the control flow of an enclave.”
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution (2018, background): “ variants of micro-architectural side-channel attacks. Previously, various micro-architectural side-channel attacks have been demonstrated on SGX, which CPU cache attacks [7, 19, 21, 60], BTB attacks [44], page-table attacks [64, 74, 82], cache-DRAM attacks [77], etc. SgxPectre Attacks are different”
SgxPectre: Stealing Intel Secrets from SGX Enclaves Via Speculative Execution (2018, background): “ variants of micro-architectural side-channel attacks. Previously, various micro-architectural side-channel attacks have been demonstrated on SGX, which CPU cache attacks [7, 19, 21, 60], BTB attacks [44], page-table attacks [64, 74, 82], cache-DRAM attacks [77], etc. SgxPectre Attacks are different”