OBFUSCURO : : A Commodity Obfuscation Engine for Intel SGX Adil - - PowerPoint PPT Presentation

OBFUSCURO: : A Commodity Obfuscation Engine for Intel SGX

Adil Ahmad*, Byunggill Joe*, Yuan Xiao Yinqian Zhang, Insik Shin, Byoungyoung Lee

(* denotes equal contribution)

Program Obfuscation

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Trusted Untrusted (except the Black box) Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine Trusted Untrusted (except the Black box) Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

𝑸𝒒𝒔𝒋𝒘

Trusted Untrusted (except the Black box) Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

…

Trusted Untrusted (except the Black box) Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

Untrusted System

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

…

Trusted Untrusted (except the Black box)

Black box

Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

Untrusted System

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

…

Trusted Untrusted (except the Black box)

Black box

Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘 Receiver’s Goal Disclose the internals

• f program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

Untrusted System

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

…

Trusted Untrusted (except the Black box)

Black box

If the black box is “secure”? Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘 Receiver’s Goal Disclose the internals

• f program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

Output

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

Untrusted System

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

… After constant time 𝑼

Trusted Untrusted (except the Black box)

Black box

If the black box is “secure”? Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘 Receiver’s Goal Disclose the internals

• f program 𝑸𝒒𝒔𝒋𝒘

Program Obfuscation

Output

𝑸𝒒𝒔𝒋𝒘

Encryption Engine

Untrusted System

Observable execution traces

𝑸𝒒𝒔𝒋𝒘

Attacker chooses inputs 𝐽0 𝐽1 𝐽𝑂

…

Φ0 Φ1 Φ𝑂

… After constant time 𝑼

Trusted Untrusted (except the Black box)

Black box

If the black box is “secure”? Sender’s Goal Protect the internals of private program 𝑸𝒒𝒔𝒋𝒘 Receiver’s Goal Disclose the internals

• f program 𝑸𝒒𝒔𝒋𝒘

Execution traces should not leak information about 𝑸𝒒𝒔𝒋𝒘

Wait, isn’t that what In Intel SGX does?

3

Wait, isn’t that what In Intel SGX does?

Program

3

Wait, isn’t that what In Intel SGX does?

Program Non- Enclave Enclave

3

Wait, isn’t that what In Intel SGX does?

Program Non- Enclave Enclave Confidentiality and integrity guarantees Trusted execution region

3

Wait, isn’t that what In Intel SGX does?

Program Non- Enclave Enclave

Operating System

(and other untrusted software)

Restricted by the processor Confidentiality and integrity guarantees Trusted execution region

3

4

In Intel SGX is not perfect!

4

Enclave

In Intel SGX is not perfect!

4

Enclave Memory accessed by the enclave

In Intel SGX is not perfect!

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Visible traces on untrusted/shared components! Timing

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Operating System

Visible traces on untrusted/shared components!

Granularity: 4KB (1 page)

Timing

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Operating System

Visible traces on untrusted/shared components!

Granularity: 4KB (1 page) Granularity: 64B (1 line)

Timing

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Operating System

Visible traces on untrusted/shared components!

Granularity: 4KB (1 page) Granularity: Jmp address Granularity: 64B (1 line)

Timing

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Operating System

Visible traces on untrusted/shared components!

Granularity: 4KB (1 page) Granularity: Jmp address Granularity: 64B (1 line)

Timing

Granularity: Execution Time

4

Enclave Memory accessed by the enclave

Access Frame #

0x1000

Page Table

Paging, Branch-prediction and Cache attacks!

[S&P14, SEC17, ASPLOS18, DIMVA17, WOOT17]

cache-set 0 cache-set 3

CPU Cache

Taken Address

0x1000

Branch Target Buffer

In Intel SGX is not perfect!

Operating System

Visible traces on untrusted/shared components!

Granularity: 4KB (1 page) Granularity: Jmp address Granularity: 64B (1 line)

Timing

Granularity: Execution Time

Learning fr from existing solutions!

5

Learning fr from existing solutions!

5

Access patterns attacks!

Transactional Memory

[NDSS17, SEC17]

Learning fr from existing solutions!

5

Access patterns attacks!

Possible Soln.

Incomplete

Transactional Memory

[NDSS17, SEC17]

Learning fr from existing solutions!

5

Access patterns attacks!

Possible Soln.

Incomplete ring-0 required

Cache Partitioning

[SEC18]

Transactional Memory

[NDSS17, SEC17]

Learning fr from existing solutions!

5

Access patterns attacks!

Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels!

Access patterns attacks!

Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels!

Access patterns attacks! Timing attacks!

Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

RDTSC

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels!

Access patterns attacks! Timing attacks!

OS-controllable

Possible Soln. Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

RDTSC Network timers

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels!

Access patterns attacks! Timing attacks!

OS-controllable OS-controllable

Possible Soln. Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

RDTSC Network timers Thread timers

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels!

Access patterns attacks! Timing attacks!

OS-controllable OS-controllable OS-controllable

Possible Soln. Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Transactional Memory

[NDSS17, SEC17]

RDTSC Network timers Thread timers

Learning fr from existing solutions!

5

Lesson #1 Ring-3 enclaves cannot hide access patterns through side-channels! Lesson #2 Unreliable timers for SGX enclaves!

Access patterns attacks! Timing attacks!

OS-controllable OS-controllable OS-controllable

Possible Soln. Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]

Our approach

6

Our approach

6

• Indistinguishable enclave program(s)

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

# of executions: 0

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Single data access # of executions: 0

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access # of executions: 0 1

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access # of executions: 0 1

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access # of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

# of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

Paging Attack: Same page # of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

Cache Attack: Same cache-lines Paging Attack: Same page # of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

Cache Attack: Same cache-lines Branch Attack: Same branch Paging Attack: Same page # of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

Cache Attack: Same cache-lines Branch Attack: Same branch Paging Attack: Same page Timing Attack: Same time to execute N code blocks # of executions: 0 1 N

Our approach

6

• Indistinguishable enclave program(s)
• A code block executed N times on C-Pad, and data block accessed from D-Pad
• C-Pad and D-Pad are one cache-line (64B) in size!

C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data access

What do the attacks reveal?

Cache Attack: Same cache-lines Branch Attack: Same branch Paging Attack: Same page Timing Attack: Same time to execute N code blocks # of executions: 0 1 N Instead of trying to hide traces,

all enclaves should leak the same traces!

Let Hermione explain!

7

Let Hermione explain!

𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟐 𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟑

Operating System

7

Let Hermione explain!

𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟐 𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟑

Operating System

Pattern Pattern

Before (Native)

7

Let Hermione explain!

𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟐 𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟑

Operating System

Pattern Pattern

Before (Native)

Obfuscuro

7

Let Hermione explain!

𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟐 𝑭𝒐𝒅𝒎𝒃𝒘𝒇𝟑

Operating System

Pattern Pattern

Before (Native) After (Obfuscuro)

Obfuscuro

7

Cool, what’s the challenge?

8

Cool, what’s the challenge?

8

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Cool, what’s the challenge?

8

C-Pad 64B

Enclave Storage

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Foo Bar Main

Translator

D-Pad

64B

Cool, what’s the challenge?

8

C-Pad 64B

Enclave Storage

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Foo Bar Main 56B 78B 67B

Translator

• C1. Native code is

not in 64B blocks!

D-Pad

64B

Cool, what’s the challenge?

8

C-Pad 64B

Enclave Storage

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Foo Bar Main 56B 78B 67B

Translator

• C1. Native code is

not in 64B blocks!

• C2. Access patterns

leaked while copying!

D-Pad

64B

Foo Bar

Cool, what’s the challenge?

8

C-Pad 64B

Enclave Storage

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Foo Bar Main 56B 78B 67B

Translator

• C1. Native code is

not in 64B blocks!

• C2. Access patterns

leaked while copying!

Foo jmp jmp Bar jmp

• C3. Code can have

different branches!

D-Pad

64B

Foo Bar

Cool, what’s the challenge?

8

C-Pad 64B

Enclave Storage

• Naïve solution
• Use a software-translator to copy all code and data onto C/D-Pad

Foo Bar Main 56B 78B 67B

Translator

• C1. Native code is

not in 64B blocks!

• C2. Access patterns

leaked while copying!

Foo jmp jmp Bar jmp

• C3. Code can have

different branches!

• C4. Timing issues

not even discussed!

D-Pad

64B

Foo Bar

Obfuscuro

• Program obfuscation on Intel SGX
• All programs should exhibit same patterns irrespective of logic/input.
• Adapted from Harry Potter spell “Obscuro” (translation :> Darkness)

9

Code Controller Data Controller

stash

• pos. map

D-Tree

C-Pad

64B

D-Pad

64B

stash

• pos. map

ORAM Bank

C-Tree

Code execution model Data access model

C1. . Enforce code blocks of f identical sizes

10

C1. . Enforce code blocks of f identical sizes

10

• Break code blocks into 64 bytes and pad using nop

C1. . Enforce code blocks of f identical sizes

10

• Break code blocks into 64 bytes and pad using nop

Foo()

Native

90B

C1. . Enforce code blocks of f identical sizes

10

• Break code blocks into 64 bytes and pad using nop

Foo()

Native

Obfuscuro Compiler 90B

C1. . Enforce code blocks of f identical sizes

10

• Break code blocks into 64 bytes and pad using nop

Foo()

Native

Obfuscuro Compiler 90B

Foo.1()

Instrumented

64B

NOPs 38 bytes

26 bytes 64B 64 bytes

Foo.2()

Split Foo()

C1. . Enforce code blocks of f identical sizes

10

• Break code blocks into 64 bytes and pad using nop

Foo()

Native

Obfuscuro Compiler 90B

Foo.1()

Instrumented

64B

NOPs 38 bytes

26 bytes 64B 64 bytes

Foo.2()

Split Foo()

64B (single cache-line) code blocks can be loaded onto the C-Pad!

C2. . Securely loading C/D-Pad

11

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

1

Execute old code block

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block Retrieve the block using ORAM

3

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block Retrieve the block using ORAM

3

Instrumented code is located in C-Tree

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block Update C-Pad with new code block

4

Retrieve the block using ORAM

3

Instrumented code is located in C-Tree

Foo.1

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block Update C-Pad with new code block

4

Retrieve the block using ORAM

3

Execute new code block

5

Instrumented code is located in C-Tree

Foo.1

C2. . Securely loading C/D-Pad

11

• Fetch code and data using Oblivious RAM (ORAM)
• The code and data is fetched onto C-Pad and D-Pad resp.

ORAM Bank

C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request new code block

2 1

Execute old code block Update C-Pad with new code block

4

Retrieve the block using ORAM

3

Execute new code block

5

Instrumented code is located in C-Tree

Foo.1

Side-channel-resistant ORAM scheme ensures no leakage as C/D-Pad are loaded!

C3. . Align branches to/from C-Pad

12

C3. . Align branches to/from C-Pad

12

• Each instrumented code block has two branches to fixed locations
• C-Pad  Code-Controller
• C-Pad  Data-Controller

C3. . Align branches to/from C-Pad

12

• Each instrumented code block has two branches to fixed locations
• C-Pad  Code-Controller
• C-Pad  Data-Controller

Code execution model Data access model

C-Pad

jmp jmp Data Controller

stash

• pos. map

Code Controller

stash

• pos. map

add sub imul

CPU-bound instructions

C3. . Align branches to/from C-Pad

12

• Each instrumented code block has two branches to fixed locations
• C-Pad  Code-Controller
• C-Pad  Data-Controller

Code execution model Data access model

C-Pad

jmp jmp Data Controller

stash

• pos. map

Code Controller

stash

• pos. map
• Src. A
• Dst. A

add sub imul

CPU-bound instructions

• Dst. B
• Src. B

Fixed

• Dst. Addr.

Fixed

• Src. Addr.

C3. . Align branches to/from C-Pad

12

• Each instrumented code block has two branches to fixed locations
• C-Pad  Code-Controller
• C-Pad  Data-Controller

Code execution model Data access model

C-Pad

jmp jmp Data Controller

stash

• pos. map

Code Controller

stash

• pos. map
• Src. A
• Dst. A

add sub imul

CPU-bound instructions

• Dst. B
• Src. B

Fixed

• Dst. Addr.

Fixed

• Src. Addr.

C/D-Controller have no conditional branches!

C3. . Align branches to/from C-Pad

12

• Each instrumented code block has two branches to fixed locations
• C-Pad  Code-Controller
• C-Pad  Data-Controller

Code execution model Data access model

C-Pad

jmp jmp Data Controller

stash

• pos. map

Code Controller

stash

• pos. map
• Src. A
• Dst. A

add sub imul

CPU-bound instructions

• Dst. B
• Src. B

Fixed

• Dst. Addr.

Fixed

• Src. Addr.

C/D-Controller have no conditional branches!

All Obfuscuro programs execute the same sequence of branches!

C4. . Ensuring execution time consistency

13

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1

Contains dummy but indistinguishable code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1 2

Retrieve the next block

Contains dummy but indistinguishable code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1 3 2

Return to C-Pad Retrieve the next block

Contains dummy but indistinguishable code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1 3 2 Term

Return to C-Pad Retrieve the next block

After N blocks

Contains dummy but indistinguishable code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1 3 2 Term 4

Return to C-Pad Fetches output and exits enclave! Retrieve the next block

After N blocks

Contains dummy but indistinguishable code blocks

C4. . Ensuring execution time consistency

13

• The program executes fixed number of code blocks

ORAM Bank C-Tree

C-Pad 64B Code Controller

stash

• pos. map

Request next code block

1 3 2 Term 4

Return to C-Pad Fetches output and exits enclave! Retrieve the next block

After N blocks

Execute N code blocks to ensure all programs terminate consistently!

Faster memory store for enclaves

14

Faster memory store for enclaves

14

• Use AVX registers as store instead of ”Oblivious” store

DRAM CPU

Faster memory store for enclaves

AVX registers

14

• Use AVX registers as store instead of ”Oblivious” store

C-Pad

64B

Code Controller

stash

• pos. map

DRAM CPU

Faster memory store for enclaves

DRAM-based store

AVX registers

Have to sequentially access all memory indices

14

• Use AVX registers as store instead of ”Oblivious” store

C-Pad

64B

Code Controller

stash

• pos. map

DRAM CPU

Faster memory store for enclaves

DRAM-based store Register-based store

AVX registers

Have to sequentially access all memory indices Can access individual registers obliviously!

14

• Use AVX registers as store instead of ”Oblivious” store

C-Pad

64B

Code Controller

stash

• pos. map

DRAM CPU

Faster memory store for enclaves

DRAM-based store Register-based store

AVX registers

Have to sequentially access all memory indices Can access individual registers obliviously!

14

• Use AVX registers as store instead of ”Oblivious” store

C-Pad

64B

Code Controller

stash

• pos. map

AVX registers can be used as a faster,

• blivious storage for SGX enclaves!

Im Implementation

15

Im Implementation

15

• LLVM compiler suite (3117 LoC)
• Breaks all code into similar blocks

(C1)

• Instrument and align all control and data-flow instructions

(C3)

Im Implementation

15

• LLVM compiler suite (3117 LoC)
• Breaks all code into similar blocks

(C1)

• Instrument and align all control and data-flow instructions

(C3)

• Runtime library (2179 LoC)
• Initializes ORAM trees and performs secure ORAM operations

(C2)

• Terminate program and fetch output

(C4)

Im Implementation

15

• LLVM compiler suite (3117 LoC)
• Breaks all code into similar blocks

(C1)

• Instrument and align all control and data-flow instructions

(C3)

• Runtime library (2179 LoC)
• Initializes ORAM trees and performs secure ORAM operations

(C2)

• Terminate program and fetch output

(C4)

• Intel SGX SDK (25 LoC)
• Assign memory regions for C/D-Pad

(support)

Performance Evaluation

16

100 200 300

16 27 68 85 121 231 Overhead (times) Programs

Performance Evaluation

16

100 200 300

16 27 68 85 121 231 Overhead (times) Programs We ported ~10 simple applications to Obfuscuro!

Performance Evaluation

16

100 200 300

16 27 68 85 121 231 Overhead (times) Programs Average overhead

• bserved is 81 times over

native programs! We ported ~10 simple applications to Obfuscuro!

Performance Evaluation

16

100 200 300

16 27 68 85 121 231 Overhead (times) Programs Average overhead

• bserved is 81 times over

native programs! The overhead is highly dependent on input size and program type! We ported ~10 simple applications to Obfuscuro!

Ending Remarks!

17

Ending Remarks!

17

• 1. Program obfuscation is a remarkable dream to achieve

Ending Remarks!

17

• 1. Program obfuscation is a remarkable dream to achieve
• 2. Various software/hardware limitations hinder the realization of

program obfuscation on Intel SGX

Ending Remarks!

17

• 1. Program obfuscation is a remarkable dream to achieve
• 2. Various software/hardware limitations hinder the realization of

program obfuscation on Intel SGX

• 3. Existing solutions have a limited approach towards side-channel

mitigation in Intel SGX

Ending Remarks!

17

• 1. Program obfuscation is a remarkable dream to achieve
• 2. Various software/hardware limitations hinder the realization of

program obfuscation on Intel SGX

• 3. Existing solutions have a limited approach towards side-channel

mitigation in Intel SGX

• 4. Obfuscuro is compiler-based scheme which addresses this issue by

ensuring all programs leak same access patterns

Adil Ahmad Contact: ahmad37@purdue.edu

18

(Translation ~ Thanks!) ;)

Execution Tim ime Evaluation

19

cycles Code block with instructions

• f each type

General programs

ORAM access time dominates the time of code block execution!