MicroScope: Enabling Microarchitectural Replay Attacks

Skarlatos, Dimitrios; Yan, Mengjia; Gopireddy, Bhargava; Sprabery, Read; Torrellas, Josep; Fletcher, Christopher W.

doi:10.1109/mm.2020.2986204

Cited by 27 publications

(34 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Enclave execution [84], such as with Intel SGX [47], protects sensitive applications from direct inspection or tampering from supervisor software. That is, the OS, hypervisor and other software are considered to be the attacker [14], [41], [45], [65], [70], [75], [78], [81], [90], [98], who will be referred to as the SGX adversary for the rest of the paper. To use SGX, users partition their applications into enclaves at some interface boundary.…”

Section: Enclave Execution and Intel Sgxmentioning

confidence: 99%

“…For example, controlled side-channel attacks [93] and follow-on work [90] provide a zero-noise mechanism for an attacker to learn a victim's memory access pattern at page (or sometimes finer) granularity. A line of work has further shown how the attacker can effectively single-step, and even replay, the victim to measure fine-grain information such as cache access pattern and arithmetic unit port contention [14], [41], [44], [45], [65], [81], [88].…”

Section: Enclave Execution and Intel Sgxmentioning

confidence: 99%

“…When R interprets &, it invokes the C routine given in Figure 2a. This snippet takes different code paths, depending on the values of x1 and x2, which the SGX adversary can detect by single-stepping [88] or by replaying the victim [81] and measuring time, branch predictor state, etc. (see below).…”

Section: B Logical Operatorsmentioning

confidence: 99%

“…Note that the execution length of these two expressions only differ by two x86-64 instructions in Figure 3. Having access to a large number of measurements may occur naturally, e.g., if the sensitive data is accessed in a loop, or if the attacker performs a µArch replay attack [81]. We make 100 trials of such measurements against R with the Intel Performance Counter Monitor (PCM) [27].…”

Section: B Logical Operatorsmentioning

confidence: 99%

“…Here, we face a challenging problem. To achieve complete security from untrusted software, it is well known that TEE software must be hardened to block a plethora of microarchitectural side channels (e.g., [14], [81], [90], [93]). Yet, existing software-based techniques to block these channels-coming from a rich line of research in data-oblivious/constant-time programming [11], [25], [66], [75]-fall short of protecting existing high-level language stacks such as R, Ruby and Python.…”

mentioning

confidence: 99%

See 4 more Smart Citations

DOVE: A Data-Oblivious Virtual Environment

Lee

Jois

Fletcher

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Section: Enclave Execution and Intel Sgxmentioning

confidence: 99%

Section: Enclave Execution and Intel Sgxmentioning

confidence: 99%

Section: B Logical Operatorsmentioning

confidence: 99%

Section: B Logical Operatorsmentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

DOVE: A Data-Oblivious Virtual Environment

Lee

Jois

Fletcher

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Privacy-preserving genotype imputation in a trusted execution environment

Dokmai¹,

Koçkan²,

Zhu³

et al. 2021

Cell Systems

View full text Add to dashboard Cite

Privacy-Preserving Genotype Imputation in a Trusted Execution Environment

Dokmai

Koçkan

Zhu

et al. 2021

Preprint

View full text Add to dashboard Cite

Genotype imputation is an essential tool in genetics research, whereby missing genotypes are inferred based on a panel of reference genomes to enhance the power of downstream analyses. Recently, public imputation servers have been developed to allow researchers to leverage increasingly large-scale and diverse genetic data repositories for imputation. However, privacy concerns associated with uploading one's genetic data to a third-party server greatly limit the utility of these services. In this paper, we introduce a practical, secure hardware-based solution for a privacy-preserving imputation service, which keeps the input genomes private from the service provider by processing the data only within a Trusted Execution Environment (TEE) offered by the Intel SGX technology. Our solution features SMac, an efficient, side-channel-resilient imputation algorithm designed for Intel SGX, which employs the hidden Markov model (HMM)-based imputation strategy also utilized by a state-of-the-art imputation software Minimac. SMac achieves imputation accuracies virtually identical to those of Minimac and provides protection against known attacks on SGX while maintaining scalability to large datasets. We additionally show the necessity of our strategies for mitigating side-channel risks by identifying vulnerabilities in existing imputation software and controlling their information exposure. Overall, our work provides a guideline for practical and secure implementation of genetic analysis tools in SGX, representing a step toward privacy-preserving analysis services that can facilitate data sharing and accelerate genetics research.

show abstract

MicroScope: Enabling Microarchitectural Replay Attacks

Cited by 27 publications

References 8 publications

DOVE: A Data-Oblivious Virtual Environment

DOVE: A Data-Oblivious Virtual Environment

Privacy-preserving genotype imputation in a trusted execution environment

Privacy-Preserving Genotype Imputation in a Trusted Execution Environment

Contact Info

Product

Resources

About