SGXCrypter: IP protection for portable executables using Intel's SGX technology

Tychalas, Dimitrios; Tsoutsos, Nektarios Georgios; Maniatakos, Michail

doi:10.1109/aspdac.2017.7858348

Cited by 14 publications

(5 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although SGX is still in its infancy, the promise of shielded execution has encouraged researchers and practitioners to develop various new applications to utilize these features (e.g., [2,22,51,54,59,68,69,85,88]), and new software tools or frameworks (e.g., [4,5,9,24,43,50,61,65,67,72,80]) to help developers adopt this emerging programming paradigm. Most recently, SGX has been adopted by commercial public clouds, such as Azure confidential computing [58], aiming to protect cloud data security even with compromised operating systems or hypervisors, or even "malicious insiders with administrative privilege".…”

Section: Introductionmentioning

confidence: 99%

SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

Chen

Xiao

et al. 2020

IEEE Secur. Privacy

118

159

View full text Add to dashboard Cite

This paper presents SgxPectre Attacks that exploit the recently disclosed CPU bugs to subvert the confidentiality and integrity of SGX enclaves. Particularly, we show that when branch prediction of the enclave code can be influenced by programs outside the enclave, the control flow of the enclave program can be temporarily altered to execute instructions that lead to observable cache-state changes. An adversary observing such changes can learn secrets inside the enclave memory or its internal registers, thus completely defeating the confidentiality guarantee offered by SGX. To demonstrate the practicality of our SgxPectre Attacks, we have systematically explored the possible attack vectors of branch target injection, approaches to win the race condition during enclave's speculative execution, and techniques to automatically search for code patterns required for launching the attacks. Our study suggests that any enclave program could be vulnerable to SgxPectre Attacks since the desired code patterns are available in most SGX runtimes (e.g., Intel SGX SDK, Rust-SGX, and Graphene-SGX). Most importantly, we have applied SgxPectre Attacks to steal seal keys and attestation keys from Intel signed quoting enclaves. The seal key can be used to decrypt sealed storage outside the enclaves and forge valid sealed data; the attestation key can be used to forge attestation signatures. For these reasons, SgxPectre Attacks practically defeat SGX's security protection. This paper also systematically evaluates Intel's existing countermeasures against SgxPectre Attacks and discusses the security implications.

show abstract

Section: Introductionmentioning

confidence: 99%

SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

Chen

Xiao

et al. 2020

IEEE Secur. Privacy

118

159

View full text Add to dashboard Cite

show abstract

“…FE allows the authorized entity to calculate the encrypted data and display a precise result. Tychalas et al [24] designed an SGX encrypter to protect the IP of various executable files in Windows from malicious static or dynamic analysis.Glamdring [25] is a new framework for protecting C programs using Intel SGX. Glamdring partitions the program at the source level to minimize the amount of code in the enclave.…”

Section: The Trusted Executing Environmentmentioning

confidence: 99%

TeTPCM: building endogenous trusted computing on trusted execution environment

Li,

Huang,

Luo

et al. 2024

International Conference on Computer Network Security and Software Engineering (CNSSE 2024)

View full text Add to dashboard Cite

“…Examples of TEEs include Intel Software Guard Extensions (SGX), AMD Secure Encrypted Virtualization (SEV), and ARM TrustZone. Among them, Intel SGX, due to its convenient development and deployment model, is widely considered the most promising TEE solution, drawing attention from both industry and academia since its introduction [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21]. Commercial clouds, such as Microsoft Azure [22] and Alibaba Cloud [23] have offered SGX platforms for confidential cloud computing.…”

Section: Introductionmentioning

confidence: 99%

MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties

Chen,

Zhang

2020

Preprint

View full text Add to dashboard Cite

Intel Software Guard Extensions (SGX) local and remote attestation mechanisms enable an enclave to attest its identity (i.e., the enclave measurement, which is the cryptographic hash of its initial code and data) to an enclave. To verify that the attested identity is trusted, one enclave usually includes the measurement of the enclave it trusts into its initial data in advance assuming no trusted third parties are available during runtime to provide this piece of information. However, when mutual trust between these two enclaves is required, it is infeasible to simultaneously include into their own initial data the other's measurements respectively as any change to the initial data will change their measurements, making the previously included measurements invalid. In this paper, we propose MAGE, a framework enabling a group of enclaves to mutually attest each other without trusted third parties. Particularly, we introduce a technique to instrument these enclaves so that each of them could derive the others' measurements using information solely from its own initial data. We also provide a prototype implementation based on Intel SGX SDK, to facilitate enclave developers to adopt this technique.

show abstract

SGXCrypter: IP protection for portable executables using Intel's SGX technology

Cited by 14 publications

References 11 publications

SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

SgxPectre: Stealing Intel Secrets From SGX Enclaves via Speculative Execution

TeTPCM: building endogenous trusted computing on trusted execution environment

MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties

Contact Info

Product

Resources

About