• TUCS Publication Series
• How to Publish in TUCS Series
• Publication Search
• Publication Graph
• Publication Input
• Publication Input Guide
• JuFo Browser

Mitigating Branch-Shadowing Attacks on Intel SGX using Control Flow Randomization

Shohreh Hosseinzadeh, Hans Liljestrand, Ville Leppänen, Andrew Paverd, Mitigating Branch-Shadowing Attacks on Intel SGX using Control Flow Randomization. In: 3rd Workshop on System Software for Trusted Execution (SysTEX 2018), 42–47, ACM, 2018.

http://dx.doi.org/10.1145/3268935.3268940

Abstract:

Intel Software Guard Extensions (SGX) is a promising hardware-based technology for protecting sensitive computation from potentially compromised system software.
However, recent research has shown that SGX is vulnerable to branch-shadowing -- a side channel attack that leaks the fine-grained (branch granularity) control flow of an enclave (SGX protected code), potentially revealing sensitive data to the attacker.
The previously-proposed defense mechanism, called Zigzagger, attempted to hide the control flow, but has been shown to be ineffective if the attacker can single-step through the enclave using the recent SGX-Step framework.

Taking into account these stronger attacker capabilities, we propose a new defense against branch-shadowing, based on control flow randomization.
Our scheme is inspired by Zigzagger, but provides quantifiable security guarantees with respect to a tunable security parameter.
Specifically, we eliminate conditional branches and hide the targets of unconditional branches using a combination of compile-time modifications and run-time code randomization.
We evaluated the performance of our approach using ten benchmarks from SGX-Nbench.
Although we considered the worst-case scenario (whole program instrumentation), our results show that, on average, our approach results in less than 18% performance loss and less than 1.2 times code size increase.

BibTeX entry:

@INPROCEEDINGS{inpHoLiLePa18a,
  title = {Mitigating Branch-Shadowing Attacks on Intel SGX using Control Flow Randomization},
  booktitle = {3rd Workshop on System Software for Trusted Execution (SysTEX 2018)},
  author = {Hosseinzadeh, Shohreh and Liljestrand, Hans and Leppänen, Ville and Paverd, Andrew},
  publisher = {ACM},
  pages = {42–47},
  year = {2018},
  keywords = {Intel SGX, side-channel attack, branch-shadowing attack},
  ISSN = {1543-7221},
}

Belongs to TUCS Research Unit(s): Software Development Laboratory (SwDev)

Publication Forum rating of this publication: level 2

Edit publication