Search

SGX-based LibOS are designed to run unmodified applications within SGX Enclave, but differences in their architecture, system call simulation, and system call forwarding can make them difficult to use and debug. To overcome these challenges, a dynamic testing framework was introduced that traced system calls and verified their behaviors in various SGX-based LibOS. This framework compared the execution of system calls within the LibOS to their execution on regular Linux hosts, analyzing the differences in call forwarding mechanisms, Linux feature replication, and runtime support for programming languages. The study aims to highlight where improvements are needed and hopefully provides guidance for future research in this area.

In cloud services, the zero-trust security paradigm has emerged as a key strategy to reduce the large attack surface created by the complexity of cloud systems. Service mesh is a popular practice to realize the zero-trust architecture, which relies heavily on network access control to achieve the desired security. Building a service mesh-based solution in the cloud is not straightforward because privileged adversaries (e.g., malicious cloud insiders) can easily compromise the control plane where the access control function is implemented. In this paper, we propose S-ZAC, an access control hardening technique for service mesh-based solutions in the cloud. S-ZAC uses Intel SGX to provide a trusted execution environment for the control plane, which is responsible for enforcing access control for the service mesh. By isolating all access-control-related functions within an SGX enclave, S-ZAC ensures high resilience of the service mesh solution even in the presence of privileged adversaries. Due to the design limitations of SGX, implementing S-ZAC in the cloud for zero trust faces several challenges that can lead to serious scalability and failover issues. The first challenge is to establish secure communication channels between the S-ZAC components, even in the presence of privileged attackers. The second challenge is the limited memory capacity of the SGX enclave. Finally, the third challenge is that the inherent design of SGX does not support persistent enclave states, meaning that any state of running enclaves is volatile. We address these challenges by proposing our novel solutions. By implementing a prototype of S-ZAC, we evaluate its performance in terms of security and performance. The evaluation results validate the effectiveness of S-ZAC to enhance the security of the service mesh control plane in cloud environments. [ABSTRACT FROM AUTHOR]

With the rapid development of the Internet of Things (IoT), more and more user devices access the network and generate large amounts of genome data. These genome data possess significant medical value when researched. However, traditional genome analysis confronts security and efficiency challenges, including access pattern leakage, low efficiency, and single analysis methods. Thus, we propose a secure and efficient dynamic analysis scheme for genome data within a Software Guard Extension (SGX)-assisted server, called SEDASGX. Our approach involves designing a secure analysis framework based on SGXs and implementing various analysis methods within the enclave. The access pattern of genome data is always obfuscated during the analysis and update process, ensuring privacy and security. Furthermore, our scheme not only achieves higher analysis efficiency but also enables dynamic updating of genome data. Our results indicate that the SEDASGX analysis method is nearly 2.5 times more efficient than non-SGX methods, significantly enhancing the analysis speed of large-scale genome data. [ABSTRACT FROM AUTHOR]

Attribute-based encryption (ABE) is a cryptographic mechanism that provides fine-grained access control to encrypted data, which can thus be stored in, e.g., public clouds. However, ABE schemes lack the notion of obligations, which is common in attribute-based access control systems such as eXtensible Access Control Markup Language and Usage Control. Obligations are used to define and enforce extra constraints that happen before approving or denying an access request. In this paper, we propose OB-ABE, a system for extending any classical ABE with enforceable obligations. Our system architecture has as core component trusted hardware enclaves, implemented with SGX, used for enforcing obligations. We employ ProVerif to formally model OB-ABE and verify its main property called "enforceable obligations," i.e., if a message is encrypted along with an obligation, then the message can be decrypted only after enforcing the attached obligation. OB-ABE has two more properties: (i) OB-ABE is a "conservative extension" of the underlying ABE scheme, preserving its security properties; (ii) OB-ABE is "backward compatible" in the sense that any ciphertext produced by an ABE scheme can be decrypted by its extended OB-ABE version, and moreover, a ciphertext produced by an OB-ABE scheme can be decrypted by its underlying ABE scheme provided that the ciphertext does not have obligations attached. We also implement in C using Intel SGX a prototype of an OB-ABE extending the well-known ciphertext-policy ABE. [ABSTRACT FROM AUTHOR]

The adoption of third-party machine learning (ML) cloud services is highly dependent on the security guarantees and the performance penalty they incur on workloads for model training and inference. This paper explores security/performance trade-offs for the distributed Apache Spark framework and its ML library. Concretely, we build upon a key insight: in specific deployment settings, one can reveal carefully chosen non-sensitive operations (e.g. statistical calculations). This allows us to considerably improve the performance of privacy-preserving solutions without exposing the protocol to pervasive ML attacks. In more detail, we propose Soteria, a system for distributed privacy-preserving ML that leverages Trusted Execution Environments (e.g. Intel SGX) to run computations over sensitive information in isolated containers (enclaves). Unlike previous work, where all ML-related computation is performed at trusted enclaves, we introduce a hybrid scheme, combining computation done inside and outside these enclaves. The experimental evaluation validates that our approach reduces the runtime of ML algorithms by up to 41% when compared to previous related work. Our protocol is accompanied by a security proof and a discussion regarding resilience against a wide spectrum of ML attacks.

Apart from the actual CPU, modern server motherboards contain other auxiliary components, for example voltage regulators for power management. Those are connected to the CPU and the separate Baseboard Management Controller (BMC) via the I2C-based PMBus. In this paper, using the case study of the widely used Supermicro X11SSL motherboard, we show how remotely exploitable software weaknesses in the BMC (or other processors with PMBus access) can be used to access the PMBus and then perform hardware-based fault injection attacks on the main CPU. The underlying weaknesses include insecure firmware encryption and signing mechanisms, a lack of authentication for the firmware upgrade process and the IPMI KCS control interface, as well as the motherboard design (with the PMBus connected to the BMC and SMBus by default). First, we show that undervolting through the PMBus allows breaking the integrity guarantees of SGX enclaves, bypassing Intel’s countermeasures against previous undervolting attacks like Plundervolt/V0ltPwn. Second, we experimentally show that overvolting outside the specified range has the potential of permanently damaging Intel Xeon CPUs, rendering the server inoperable. We assess the impact of our findings on other server motherboards made by Supermicro and ASRock. Our attacks, dubbed PMFault, can be carried out by a privileged software adversary and do not require physical access to the server motherboard or knowledge of the BMC login credentials. We responsibly disclosed the issues reported in this paper to Supermicro and discuss possible countermeasures at different levels. To the best of our knowledge, the 12th generation of Supermicro motherboards, which was designed before we reported PMFault to Supermicro, is not vulnerable.

Intel SGX improves the security of applications by shielding code and data from untrusted software in enclaves. Since enclaves lose their state when closed, that state has to be sealed, i.e., cryptographically protected with a secret key, and stored outside the enclave boundary. In SGX, the used key is bound to both the enclave and the processor that sealed the data, so it is unfeasible for any enclave in another computer to derive the same secret key to unseal such data. This offers security to the data, but also makes it impossible to recover that data if the original computer is damaged or stolen. In order to support backup and recovery of data sealed by enclaves, we propose SRX, a solution for sharing sealed data amongst a restricted set of SGX-enabled computers executing the same enclave code. Enclaves using SRX have access to common keys to seal and unseal enclave data, allowing the sharing of sealed data among the trusted domain. SRX guarantees that these secret keys are never exposed outside the trusted domain. SRX was implemented and evaluated with two applications: a bitcoin wallet and a password manager.

Program control flow reflects the algorithm of that program and may reveal implementation vulnerabilities. Thus its confidentiality needs to be protected, especially in a cloud setting. However, most existing control flow obfuscation methods are software-based, which cannot offer high confidentiality while maintaining low performance overhead. In this paper, we propose CFHider, a hardware-assisted solution. By performing program transformation and leveraging Trusted Execution Environments (Intel SGX), CFHider moves branch statement conditions to an opaque and trusted memory space during the program execution. We proved that by generating Obfuscation Invariants, CFHider is able to provide provable control flow confidentiality protection. Based on the design of CFHider, we also developed a prototype system for Java applications. Our security analysis and experimental results indicate that CFHider is effective in protecting control flow confidentiality and incurs a much reduced performance overhead than existing software-based solutions (by a factor of 18.1). [ABSTRACT FROM AUTHOR]

Intel SGX (Software Guard Extensions) is a hardware-based security solution that provides a trusted computing environment. SGX creates an isolated memory area called enclave and prevents any illegal access from outside of the enclave. SGX only allows executables already linked statically to the enclave when compiling executables to access its memory, so code injection attacks to SGX are not effective. However, as a previous study has demonstrated, Return-Oriented Programming (ROP) attacks can overcome this defense mechanism by injecting a series of addresses of executable codes inside the enclave. In this study, we propose a novel ROP attack, called SGXDump, which can repeat the attack payload. SGXDump consists only of gadgets in the enclave and unlike previous ROP attacks, the SGXDump attack can repeat the attack payload, communicate with other channels, and implement conditional statements. We successfully attacked two well-known SGX projects, mbedTLS-SGX and Graphene-SGX. Based on our attack experiences, it seems highly probable that an SGXDump attack can leak the entire enclave memory if there is an exploitable memory corruption vulnerability in the target SGX application. [ABSTRACT FROM AUTHOR]

The development of Industrial Internet of Things (IIoT) provides massive abundant data resources for trading and mining. However, the existing data trading schemes achieve data usage control at the cost of high latency, thereby resulting in poor service quality as the values of IIoT data degrade over time. This article proposes a monitor-based usage control model to enforce data usage policies on the user side, which eliminates frequent interactions between owners and users. Based on that, a data trading scheme with efficient usage control for IIoT (called DTSI) is devised, which utilizes blockchain smart contract and software guard extensions (SGX) to enable owners to fully control users’ identities and operations at minimal overhead. Security analysis shows that DTSI effectively prevents data abuse and ensures the fair exchange of data. Meanwhile, extensive experiments are conducted on the DTSI prototype comparing with the state-of-the-art schemes with real-world IIoT datasets, which demonstrates the efficiency of DTSI. [ABSTRACT FROM AUTHOR]

Deploying data storage and query service in an untrusted cloud server raises critical privacy and security concerns. This paper focuses on the fundamental problem of processing conjunctive keyword queries over an untrusted cloud in a privacy-preserving manner. Previous tree-based searchable symmetric encryption (SSE) schemes, such as IBTree and VBTree, can process conjunctive keyword queries in a secure and efficient way. However, these schemes cannot address “Result Pattern (RP)” leakage, which can be used to recover the keywords contained in a conjunctive keyword query. To combat this challenging problem, we propose a result pattern hiding conjunctive query scheme named Rphx using Intel SGX. In particular, we first propose a new “SGX-aware” compressed index named VIBT by combining variable-length bloom filter tree, matryoshka filter and online cipher. To achieve RP hiding, we then introduce a new tree-based SSE scheme named Rphx by deploying VIBT to Intel SGX. Security analysis shows that Rphx can enhance the security requirements by hiding RP leakage under the IND-CKA2 security model. Experimental results show that VIBT gains at least $30\times $ improvement in storage efficiency and Rphx can achieve comparable search efficiency comparing with previous works. [ABSTRACT FROM AUTHOR]

Android has stood at a predominant position in mobile operating systems for many years. However, its popularity and openness make it a desirable target of malicious attackers. There is an increasing need for mobile malware detection. Existing analysis methods fall into two categories, i.e., static analysis and dynamic analysis. The dynamic analysis is more effective and timely than the static one, but it incurs a high computational overhead, thus cannot be deployed in resource-constrained mobile devices. Existing studies solve this issue by outsourcing malware detection to the cloud. However, the privacy of mobile app runtime data uploaded to the cloud is not well preserved during both detection model training and malware detection. Numerous efforts have been made to preserve privacy with cryptography, which suffers from high computational overhead and low flexibility. To address these issues, in this paper, we propose an Intel SGX-empowered mobile malware detection scheme called EPMDroid. We also design a probabilistic data structure based on cuckoo filters, named CuckooTable, to effectively fuse features for detection and achieve high space efficiency. We conduct both theoretical analysis and real-world data based tests on EPMDroid performance. Experimental results show that EPMDroid can speed up malware detection by up to 43.8 times and save memory space by up to 3.7 times with the same accuracy, as compared to a baseline method. • A privacy-preserving malware detection scheme based on Intel SGX. • An efficient way to compress runtime app features for malware detection. • Theoretical analysis on security, privacy, computation complexity and space overhead. • A prototype to evaluate effectiveness, efficiency, scalability and memory cost. [ABSTRACT FROM AUTHOR]

This article analyzes a previously overlooked attack surface that allows unprivileged adversaries to impact floating-point computations in enclaves through the Application Binary Interface (ABI). In a comprehensive study across 7 industry-standard and research enclave shielding runtimes for Intel Software Guard Extensions (SGX), we show that control and state registers of the x87 Floating-Point Unit (FPU) and Intel Streaming SIMD Extensions are not always properly sanitized on enclave entry. We furthermore show that this attack goes beyond the x86 architecture and can also affect RISC-V enclaves. Focusing on SGX, we abuse the adversary's control over precision and rounding modes as an ABI fault injection primitive to corrupt enclaved floating-point operations. Our analysis reveals that this is especially relevant for applications that use the older x87 FPU, which is still under certain conditions used by modern compilers. We exemplify the potential impact of ABI quality-degradation attacks for enclaved machine learning and for the SPEC benchmarks. We then explore the impact on confidentiality, showing that control over exception masks can be abused as a controlled channel to recover enclaved multiplication operands. Our findings, affecting 5 of 7 studied SGX runtimes and one RISC-V runtime, demonstrate the challenges of implementing high-assurance trusted execution across computing architectures. [ABSTRACT FROM AUTHOR]

Trusted Execution Environments have been applied to improve data security in many distinct application scenarios since they enable data processing in a separate and protected region of memory. To investigate how this technology has been applied to the different IoT scenarios, which commonly deal with specific characteristics such as device resource constraints, we carried out a systematic literature review. For this, we selected and analyzed 58 papers from different conferences and journals, identifying the main IoT solutions and scenarios in which TEE has been employed. We also gathered the mentioned TEE advantages and disadvantages as well as the suggestions for future works. This study gives a general overview of the use of TEEs for cloud/fog-based IoT applications, bringing some challenges and directions.

With the convergence of fixed and mobile networks, heterogeneous networks are becoming ubiquitous. Internet giants are seeing the plight of identity authentication. To address this issue, unified access management (UAM) was conceived. This paper provides a novel unified access management scheme, named SGX-UAM, with one-time passwords (OTPs) based on Intel software guard extensions (SGX). SGX-UAM outperforms generic UAM for providing resistance to most client attacks, man-in-the-middle (MITM) attacks, phishing attacks, most replay attacks and most denial of service (DoS) attacks to which generic UAM implementaions are vulnerable. Specifically, client attacks are prevented by ensuring input security and memory security, where the former is achieved through shuffle mapping and “periodic hooking” strategy, the latter is mainly guaranteed by Intel SGX; MITM attacks are prevented by transferring ciphertext rather than plaintext; phishing attacks are avoided by authorization control; replay attacks cannot succeed because we adopts OTPs, which contain time-related dynamic factors that expire in a few seconds; as for DoS attack, we blunted its edge by blocking-invocation for identical user connection. SGX-UAM also differs from generic UAM in that it relieves the security concerns of sevice providers (SPs) and protects users' privacy at little cost of performance. An exceptional value of SGX-UAM is that it brings a lightweight OTP solution that eliminates the need of additional hardware devices, thus reducing the costs. The experimental results show that SGX-UAM consumes almost the same time with OpenID and OAuth2.0 for one login request and performs steadily when handling sequential login requests. Furthermore, the resource usage for SGX-UAM is acceptable.

A trusted execution environment (TEE) is a new hardware security feature that is isolated from a normal OS (i.e., rich execution environment (REE)). The TEE enables us to run a critical process, but the behavior is invisible from the normal OS, which makes it difficult to debug and tune the performance. In addition, the hardware/software architectures of TEE are different on CPUs. For example, Intel SGX allows user-mode only, although Arm TrustZone and RISC-V Keystone run a trusted OS. In addition, each TEE has each SDK for programming. Each SDK offers own APIs and makes difficult to write a common program. These features make it difficult to compare the performance fairly between TEE and REE on different CPUs. To obtain precise performance and behavior in TEE, we propose TS-perf which is a compiler-based performance measurement method. TS-perf accesses the hardware timestamp counter in TEE as well as REE and keeps a precise log. The codes for measurement are inserted in a TEE binary by the compiler options (i.e., profile option, constructor, and destructor). Furthermore, we utilize the separate compilation technique, and the same benchmark binary is used for a fair comparison between TEE and REE. The architecture of TS-perf is general and implemented for three TEE architectures (Arm TrustZone, Intel SGX, and RISC-V Keystone). TS-perf measures the performance of GlobalPlatform’s TEE internal APIs, matrix multiplication, memory access, and storage access. The comparisons show the difference in performance between TEE and REE and the unusual behavior of trusted applications (TAs).

In designing an access control scheme for public wireless LAN (WLAN), user privacy protection and user accountability are two conflict goals. A novel user management and access control scheme was proposed to solve this problem by utilizing the bitcoin blockchain and Intel SGX. It utilized unmodified bitcoin blockchain to manage the ownership of access credentials for users without relying on any trusted third party. It adopted Intel SGX-based mixing technology to enhance anonymity of users’ access credentials. It designed verification path rule to resolve the conflicts between the privacy-preserving and accountability objectives. The effectiveness and feasibility of the proposed scheme are also demonstrated by security analysis and performance evaluation.

A recent innovation in the trusted execution environment (TEE) technologies enables the delegation of privacy-preserving computation to the cloud system. In particular, Intel SGX, an extension of x86 instruction set architecture (ISA), accelerates this trend by offering hardware-protected isolation with near-native performance. However, SGX inherently suffers from performance degradation depending on the workload characteristics due to the hardware restriction and design decisions that primarily concern the security guarantee. The system-level optimizations on SGX runtime and kernel module have been proposed to resolve this, but they cannot effectively reflect application-specific characteristics that largely impact the performance of legacy SGX applications. This work presents an optimization strategy to achieve application-level optimization by utilizing asynchronous switchless calls to reduce enclave transition, one of the dominant overheads of using SGX. Based on the systematic analysis, our methodology examines the performance benefit for each enclave transition wrapper and selectively applies switchless calls without modifying the legacy codebases. The evaluation shows that our optimization strategy successfully improves the end-to-end performance of our showcasing application, an SGX-enabled network middlebox. [ABSTRACT FROM AUTHOR]

Electronic voting (E-voting), a crucial method in modern society, balances efficiency with the need for equity, reliability, and privacy to accurately record votes and maintain democracy. However, there is the challenge of potential leakage of voting information in scenarios where administrators of voting system may act maliciously. Moreover, contemporary collaborative counting methods face a significant increase in the cost of storage and heightened communication overhead in large-scale e-voting. In response, this paper proposes an innovative online voting protocol that integrates Intel SGX, homomorphic encryption, and zero-knowledge proof. This protocol aims to cut down the cost of communication and storage while maximizing the protection of voter privacy. The protocol relies on SGX to provide a trusted execution environment for the voting process, guarding against malicious attacks from external software or high-privileged administrators. In the proposed protocol, voters apply homomorphic encryption algorithms to locally encrypt their ballots, no longer relying on other entities (such as the voting system or SGX) for encryption. Then the encrypted ballots are submitted to SGX to mitigate the threat of data leakage in SGX. Through the adoption of zero-knowledge proof technology, the voting protocol can verify the legitimacy of votes without revealing their content. The proposed solution introduces the SGXVOT architecture, comprising two enclaves – Enclave V responsible for tallying individual encrypted votes, and Enclave T responsible for decrypting and publishing voting results. This design ensures that individual voters' ballots remain in ciphertext, preserving the confidentiality of votes and voter privacy. Additionally, the protocol incorporates a "One-Time Pad" encryption communication protocol to guarantee the confidentiality of communication messages between Enclave V and Enclave T. The thorough security analysis and performance evaluation demonstrate the superior performance of the proposed solution in terms of security, practicality, and scalability. [ABSTRACT FROM AUTHOR]