[论文解读] Software Grand Exposure: SGX Cache Attacks Are Practical

Ferdinand Brasser, Urs Müller+4 more|arXiv (Cornell University)|Feb 24, 2017

Security and Verification in Computing参考文献 40被引用 241

一句话总结

本文展示了基于缓存的实用侧信道攻击针对 SGX enclaves，显示攻击者可以在不中断 enclave 执行的情况下提取大量秘密信息，包括 RSA-2048 密钥的 70% 和基因组序列的检测。

ABSTRACT

Side-channel information leakage is a known limitation of SGX. Researchers have demonstrated that secret-dependent information can be extracted from enclave execution through page-fault access patterns. Consequently, various recent research efforts are actively seeking countermeasures to SGX side-channel attacks. It is widely assumed that SGX may be vulnerable to other side channels, such as cache access pattern monitoring, as well. However, prior to our work, the practicality and the extent of such information leakage was not studied. In this paper we demonstrate that cache-based attacks are indeed a serious threat to the confidentiality of SGX-protected programs. Our goal was to design an attack that is hard to mitigate using known defenses, and therefore we mount our attack without interrupting enclave execution. This approach has major technical challenges, since the existing cache monitoring techniques experience significant noise if the victim process is not interrupted. We designed and implemented novel attack techniques to reduce this noise by leveraging the capabilities of the privileged adversary. Our attacks are able to recover confidential information from SGX enclaves, which we illustrate in two example cases: extraction of an entire RSA-2048 key during RSA decryption, and detection of specific human genome sequences during genomic indexing. We show that our attacks are more effective than previous cache attacks and harder to mitigate than previous SGX side-channel attacks.

研究动机与目标

• 在操作系统被妥协的现实攻击者模型下，表明 SGX enclaves 易受基于缓存的侧信道攻击。
• 展示如何在不中断 enclave 执行的情况下，在 SGX 上执行有效的 Prime+Probe 缓存攻击。
• 量化 SGX 内加密运算和非加密工作负载（基因组索引）中的信息泄露。
• 评估现有防御措施并讨论为何它们无法缓解所呈现的攻击。

提出的方法

• 通过在专用核心上让攻击者和受害者运行，将 Prime+Probe 缓存侧信道技术适配到 SGX，以最小化噪声。
• 使用 Performance Monitoring Counters (PMCs) 来检测缓存行抹除/被驱逐，规避 enclave 端 PMC 限制。
• 通过修改操作系统调度来隔离攻击核心并减少中断，以维持 enclave 执行的不间断。
• 以高频率监控缓存行的抹除，并在多个阶段对齐结果以重构受害者的访问模式。
• 将攻击应用于 RSA 解密和基因组索引工作流，以演示密码学和非密码学泄露。

实验结果

研究问题

• RQ1 SGX enclaves 是否能通过缓存访问模式在不中断 enclave 执行的情况下泄露依赖于秘密的信息？
• RQ2 针对密码学（RSA）和非密码学（基因组索引）工作负载，基于缓存的泄露在多大程度上具有可行性和范围？
• RQ3 现有防御在对抗非中断的 SGX 缓存攻击方面表现如何？

主要发现

• 对 SGX 的缓存攻击是可行的，且无需中断 enclave 执行就能提取有意义的秘密信息。
• 在 RSA 解密中，攻击从 300 次重复解密和 15 次重复跨 10 个监控乘数中恢复了 70% 的 2048 位密钥。
• 该 RSA 攻击利用对预计算乘数的监控；在一个 epoch 内对每个乘数观察到 16 次重复访问即可进行候选识别。
• 对于基因组索引工作负载，攻击者可以通过观察基因组依赖的哈希表访问来检测微卫星序列。
• 如 T-SGX 和 Déjá Vu 等当前防御措施在实践中不能缓解所呈现的非中断缓存攻击。
• 这些攻击在效果上超越了先前的基于缓存的 SGX 攻击，并且比某些先前的 SGX 旁路通道方法更难缓解。