Hardware Enclaves & In Intel SGX CS261 Hardware Enclaves HW - - PowerPoint PPT Presentation

Hardware Enclaves & In Intel SGX

CS261

Hardware Enclaves

• HW abstractions for distributing trusted execution to

untrusted platforms

2

Hardware Enclaves

• HW abstractions for distributing trusted execution to

untrusted platforms

3

Sensitive data (e.g., medical records)

Encrypted Encrypted Encrypted Encrypted Encrypted

System Threats to Trusted Execution

• What can go wrong?
• Side channels
• out of scope for Intel SGX
• Counterfeit software
• Inject rootkits into OS
• Privilege escalation
• Install malicious kernel
• Compromised HW devices
• Cold-boot attacks

4

Medical System Operating System

Login DL from server Decrypted

Process

Threat Model of Hardware Enclaves

5

Enclave Enclave Code Enclave Data

Trusted

Intel Attestation Service (IAS) Process Process Other Enclave OS and/or Hypervisor

Untrusted

Off-chip devices

Elements of Hardware Enclaves

• Secure boot: HW-verified measurement + first instruction
• On-chip program isolation
• Cryptographically protected external memory
• Execution integrity; no interference from attackers
• Attestation and/or secret sealing

6

Process Enclave SECS

ECREATE

Enclave Creation with Intel SGX

• ECREATE(SECS):

create an enclave range

• EADD(SECS, addr, prot),

EEXTEND(SECS, addr): add a page to enclave and measure the content

• EINIT(SECS, license):

check & initialize an enclave

7

OS CPU TCS Code Data

EADD EEXTEND EINIT

Enclave Enter & Exit

• EENTER(SECS, TCS):

enter at a static enclave addr

• EEXIT(addr):

exit enclave to any addr

• Enclave can accept parameters

after the entry

• Attackers cannot interfere

control flow unpredictably

8

Process Enclave SECS TCS Code Data

Entry addr entry: EENTER cmp 0, rax … EEXIT exit: cmp 0, rsi …

Enclave Isolation

9

Process Enclave Process

x = *(encl_addr); x = *(encl_addr);

Enclave Mode Non-Enclave Mode Physical Memory EPC Page Mapping Controlled by Page Table + EPCM

Abort page semantic: EPC pages contains all 0s for execution outside the enclave

Memory Encryption Engine

• EPC pages are encrypted in DRAM
• Memory Encryption Engine (MEE) sits at the edge of CPU,

connected to Memory Controller (MC)

• Cachelines are decrypted at cache misses, and re-encrypted

when being written back to DRAM

10

EPC (plaintext)

Memory Encryption Engine

11

0x80200000 0x80200040 0x80200080 0x802000c0 0x80200100 0x80200140 0x80200180

Enc (e.g., AES-GCM) Cipher MAC Counter (nonce)

EPC Paging

• EPC pages are limited: currently 93.5 MB on each platform
• Untrusted OS swaps the pages for enclaves
• Swapped-out pages are not in EPC, so no longer protected

by MEE

12

VA

EPC Paging

• EWB:

copy a EPC page to non- EPC page

• ELDU:

copy a non-EPC page to EPC page

13

Process Enclave Physical Memory EPC

EWB ELDU

Enc MAC Counter (nonce)

Execution Integrity

• Program states in either enclave memory or registers
• Enclave can be interrupted
• Page faults (Paging)
• Scheduling events
• Exceptions or signals
• Interrupt  Asynchronous Exit (AEX)
• Register values dumped inside enclave before exit
• OS can only: (1) resume the enclave execution

(2) re-enter enclave for exception handling

14

Attestation

• Proof that the program runs in a genuine enclave
• Each enclave has a set of unique keys
• Report key

– intra-platform (local) attestation

• Attestation key

– inter-platform (remote) attestation

• Seal key

– Sealing enclave secrets

• Other keys

– see Intel SDM

• Generated by a root secret (EPID) hidden in Intel CPU
• Verified by Intel Attestation Service

15

Local Attestation

Attestation Procedure

16

IAS Remote Entity Enclave CPU Quoting Enclave

Nonce EREPORT (Nonce, MRQuote) Report, MACReport EGETKEY(MRX) Report KeyQuote,X Verify report EGETKEY Attestation Key (Only accessible in Quoting Enclave) CertificateMR, Nonce CertificateMR, Nonce Verify Certificate

Use Cases for Hardware Enclaves

• Digital Right Management (DRM)
• Computation outsourcing, NFV
• Distributed system, edge computing, blockchains
• Alternative to HME or MPC
• Protection for antivirus, JIT compilers, etc
• Used for concealing attacks

17

Questions?

Hardware Enclaves & Intel SGX

18