Verifying Linearizability of Intel® Software Guard Extensions

Abstract

Intel R Software Guard Extensions (SGX) is a collection of CPU instructions that enable an application to create secure containers that are inaccessible to untrusted entities, including the operating system and other low-level software. Establishing that the design of these instructions provides security is critical to the success of the feature, however, SGX introduces complex concurrent interactions between the instructions and the shared hardware state used to enforce security, rendering traditional approaches to validation insufficient. In this paper, we introduce Accordion, a domain specific language and compiler for automatically verifying linearizability via model checking. The compiler determines an appropriate linearization point for each instruction, computes the required linearizability assertions, and supports experimentation with a variety of model configurations across multiple model checking tools. We show that this approach to verifying linearizability works well for validating SGX and that the compiler provides improved usability over encoding the problem in a model checker directly.

Demystifying Attestation in Intel Trust Domain Extensions via Formal Verification

“…However, Intel has described some works, e.g., [27], on the formal verification of Intel SGX focusing on the enclave page management and page table translations tracking [28]. Intel addresses the verification in two steps: first, to prove the sequential correctness, and second, to prove that SGX is linearizable [15]. Some undiscovered bugs were identified in both steps [27].…”

“…DVF has a couple of limitations. First, it does not model concurrency, whereas SGX has 22 instructions that share the concurrent data structure, some of which contain as many as 50 interleaving points [15]. Second, the verification is semi-automated and includes a painful process of manually generating the auxiliary invariants [30].…”

“…To address concurrency issues, Intel considers linearizability [31] as a correctness condition. Intel develops a framework called iPave [14] to prove SGX linearizability, and finds the linearization point using heuristics [15]. The properties, such as system invariants or per-state assertion, can be specified [27].…”

“…To overcome this limitation of testing, rigorous and sound formal methods have been utilized to analyze the security goals on a formal model. For instance, Intel developed some formal tools [13]- [15] for establishing formal correctness of SGX. However, the verification using these tools does not cover the attestation process, which is a crucial part of Intel SGX for practical use [16].…”

Modular Verification of Programs with Effects and Effect Handlers in Coq

“…For many years, industrial manufacturers [10,11] and researchers [12,13] have aimed to formally specify and verify hardware architectures. However, verifying properties of existing computing platforms poses significant challenges, because they tend to be both complex and under-specified; we are not aware of any model of an existing and broadly used computing system that is comprehensive in terms of its hardware and software components.…”