Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! # of executions: 0 C-Pad 64B D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! # of executions: 0 C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 C-Pad Branch to the start of C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 C-Pad Branch to the start of C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N C-Pad Branch to the start of C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N What do the attacks reveal? C-Pad Branch to the start of C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N What do the attacks reveal? C-Pad Paging Attack: Same page Branch to the start of C-Pad Single data 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N What do the attacks reveal? C-Pad Paging Attack: Same page Branch to the start of C-Pad Single data Cache Attack: Same cache-lines 64B access D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N What do the attacks reveal? C-Pad Paging Attack: Same page Branch to the start of C-Pad Single data Cache Attack: Same cache-lines 64B access Branch Attack: Same branch D-Pad 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! 1 # of executions: 0 N What do the attacks reveal? C-Pad Paging Attack: Same page Branch to the start of C-Pad Single data Cache Attack: Same cache-lines 64B access Branch Attack: Same branch D-Pad Timing Attack: Same time to execute N code blocks 64B 6
Our approach • Indistinguishable enclave program(s) • A code block executed N times on C-Pad, and data block accessed from D-Pad • C-Pad and D-Pad are one cache-line (64B) in size! N Instead of trying to hide traces, 1 # of executions: 0 What do the attacks reveal? C-Pad Paging Attack: Same page all enclaves should leak the same traces! Branch to the start of C-Pad Single data Cache Attack: Same cache-lines 64B access Branch Attack: Same branch D-Pad Timing Attack: Same time to execute N code blocks 64B 6
Let Hermione explain! 7
Let Hermione explain! 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟐 Operating System 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟑 7
Let Hermione explain! Before (Native) Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟐 Operating System Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟑 7
Let Hermione explain! Ob fu scuro Before (Native) Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟐 Operating System Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟑 7
Let Hermione explain! Ob fu scuro Before After (Native) (Obfuscuro) Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟐 Operating System Pattern 𝑭𝒐𝒅𝒎𝒃𝒘𝒇 𝟑 7
Cool, what’s the challenge? 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad C-Pad Enclave Storage Translator Foo Bar 64B Main D-Pad 64B 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad C1. Native code is C-Pad not in 64B blocks! Enclave Storage Translator 56B Foo Bar 78B 64B 67B Main D-Pad 64B 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad C1. Native code is C-Pad not in 64B blocks! Enclave Storage Foo Translator 56B Foo Bar Bar 78B 64B 67B Main D-Pad C2. Access patterns leaked while copying! 64B 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad C3. Code can have different branches! C1. Native code is C-Pad not in 64B blocks! Enclave Storage Bar Foo Foo Translator 56B jmp Foo Bar jmp jmp Bar 78B 64B 67B Main D-Pad C2. Access patterns leaked while copying! 64B 8
Cool, what’s the challenge? • Naïve solution • Use a software-translator to copy all code and data onto C/D-Pad C3. Code can have different branches! C1. Native code is C-Pad not in 64B blocks! Enclave Storage Bar Foo C4. Timing issues Foo Translator 56B jmp Foo Bar jmp not even discussed! jmp Bar 78B 64B 67B Main D-Pad C2. Access patterns leaked while copying! 64B 8
Obfuscuro • Program obfuscation on Intel SGX • All programs should exhibit same patterns irrespective of logic/input. • Adapted from Harry Potter spell “ Obscuro ” (translation :> Darkness) ORAM Bank Code C-Pad Controller C-Tree stash pos. map 64B Data D-Tree D-Pad Controller stash Code execution model pos. map Data access model 64B 9
C1. . Enforce code blocks of f identical sizes 10
C1. . Enforce code blocks of f identical sizes • Break code blocks into 64 bytes and pad using nop 10
C1. . Enforce code blocks of f identical sizes • Break code blocks into 64 bytes and pad using nop Foo() 90B Native 10
C1. . Enforce code blocks of f identical sizes • Break code blocks into 64 bytes and pad using nop Foo() Obfuscuro 90B Compiler Native 10
C1. . Enforce code blocks of f identical sizes • Break code blocks into 64 bytes and pad using nop Foo.1() 64 bytes 64B Foo() Split Obfuscuro Foo.2() 90B Foo() Compiler 26 bytes 64B Native NOPs 38 bytes Instrumented 10
C1. . Enforce code blocks of f identical sizes • Break code blocks into 64 bytes and pad using nop Foo.1() 64 bytes 64B Foo() 64B (single cache-line) code blocks can be Split Obfuscuro loaded onto the C-Pad! Foo.2() 90B Foo() Compiler 26 bytes 64B Native NOPs 38 bytes Instrumented 10
C2. . Securely loading C/D-Pad 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. C-Pad Code C-Tree Controller stash 64B pos. map ORAM Bank 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. C-Pad Code C-Tree Controller 1 stash Execute old 64B pos. map code block ORAM Bank 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. C-Pad Code C-Tree Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. Retrieve the block using ORAM C-Pad Code 3 C-Tree Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. Retrieve the block Instrumented code using ORAM is located in C-Tree C-Pad Code 3 C-Tree Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. Update C-Pad with Retrieve the block Instrumented code new code block using ORAM is located in C-Tree 4 C-Pad Code 3 C-Tree Foo.1 Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. Execute new Update C-Pad with Retrieve the block Instrumented code code block new code block using ORAM is located in C-Tree 5 4 C-Pad Code 3 C-Tree Foo.1 Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C2. . Securely loading C/D-Pad • Fetch code and data using Oblivious RAM (ORAM) • The code and data is fetched onto C-Pad and D-Pad resp. Execute new Update C-Pad with Retrieve the block Instrumented code code block new code block Side-channel-resistant ORAM scheme ensures using ORAM is located in C-Tree 5 4 C-Pad Code 3 C-Tree no leakage as C/D-Pad are loaded! Foo.1 Controller 1 stash Execute old 64B pos. map code block Request new ORAM Bank 2 code block 11
C3. . Align branches to/from C-Pad 12
C3. . Align branches to/from C-Pad • Each instrumented code block has two branches to fixed locations • C-Pad Code-Controller • C-Pad Data-Controller 12
C3. . Align branches to/from C-Pad • Each instrumented code block has two branches to fixed locations • C-Pad Code-Controller • C-Pad Data-Controller Code execution model Data access model Data C-Pad Controller jmp stash add pos. map CPU-bound sub instructions imul Code Controller jmp stash pos. map 12
C3. . Align branches to/from C-Pad • Each instrumented code block has two branches to fixed locations • C-Pad Code-Controller • C-Pad Data-Controller Code execution model Data access model Fixed Fixed Dst. Addr. Src. Addr. Data C-Pad Controller Dst. A Src. A jmp stash add pos. map CPU-bound sub instructions imul Code Dst. B Src. B Controller jmp stash pos. map 12
C3. . Align branches to/from C-Pad • Each instrumented code block has two branches to fixed locations • C-Pad Code-Controller • C-Pad Data-Controller Code execution model Data access model Fixed Fixed Dst. Addr. Src. Addr. Data C-Pad Controller Dst. A Src. A jmp stash C/D-Controller have add pos. map CPU-bound no conditional sub instructions imul branches! Code Dst. B Src. B Controller jmp stash pos. map 12
C3. . Align branches to/from C-Pad • Each instrumented code block has two branches to fixed locations • C-Pad Code-Controller • C-Pad Data-Controller Code execution model Data access model Fixed Fixed All Obfuscuro programs execute the Dst. Addr. Src. Addr. Data C-Pad same sequence of branches ! Controller Dst. A Src. A jmp stash C/D-Controller have add pos. map CPU-bound no conditional sub instructions imul branches! Code Dst. B Src. B Controller jmp stash pos. map 12
C4. . Ensuring execution time consistency 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks C-Pad Code C-Tree Controller stash 64B pos. map ORAM Bank 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks C-Pad Code C-Tree Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks Contains dummy but indistinguishable code Retrieve the blocks next block C-Pad Code C-Tree 2 Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks Contains dummy but indistinguishable code Retrieve the Return to C-Pad blocks next block 3 C-Pad Code C-Tree 2 Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks Term After N blocks Contains dummy but indistinguishable code Retrieve the Return to C-Pad blocks next block 3 C-Pad Code C-Tree 2 Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks Fetches output Term 4 and exits enclave! After N blocks Contains dummy but indistinguishable code Retrieve the Return to C-Pad blocks next block 3 C-Pad Code C-Tree 2 Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
C4. . Ensuring execution time consistency • The program executes fixed number of code blocks Fetches output Term 4 and exits enclave! After N blocks Execute N code blocks to ensure all Contains dummy but indistinguishable code Retrieve the programs terminate consistently! Return to C-Pad blocks next block 3 C-Pad Code C-Tree 2 Controller stash 64B pos. map Request next 1 ORAM Bank code block 13
Faster memory store for enclaves 14
Faster memory store for enclaves • Use AVX registers as store instead of ”Oblivious” store 14
Faster memory store for enclaves • Use AVX registers as store instead of ”Oblivious” store DRAM Code C-Pad Controller stash pos. map 64B AVX registers CPU 14
Faster memory store for enclaves • Use AVX registers as store instead of ”Oblivious” store Have to sequentially access all memory indices DRAM-based DRAM store Code C-Pad Controller stash pos. map 64B AVX registers CPU 14
Faster memory store for enclaves • Use AVX registers as store instead of ”Oblivious” store Have to sequentially access all memory indices DRAM-based DRAM store Code C-Pad Controller Can access individual stash registers obliviously! pos. map 64B AVX registers CPU Register-based store 14
Recommend
More recommend
