Composable Cachelets: Protecting Enclaves from Cache Side-Channel Attacks
Composable Cachelets: Protecting Enclaves from Cache Side-Channel Attacks
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Daniel Townley;Kerem Arikan;Yu David Liu;Dmitry Ponomarev;Oğuz Ergin
中科院分区：
文献类型：
--
作者：
Daniel Townley;Kerem Arikan;Yu David Liu;Dmitry Ponomarev;Oğuz Ergin
独立执行架构(如Intel SGX)的安全性已受到最近出现的侧通道攻击的明显威胁。(fi)缓存侧通道攻击允许攻击者在不直接访问飞地内存的情况下泄露存储在隔离飞地内的机密。在某些情况下，即使不知道受攻击的应用程序代码或不具有操作系统级别的权限，也可能会泄露机密。提出了Composable Cachelets(CC)的概念，这是一种新的可扩展的策略，用于动态划分末级缓存(LLC)，以完全隔离Enclaves与其他应用程序和彼此之间的隔离。CC支持缓存中的Enclave隔离，能够随着Enclave的创建和销毁动态调整缓存容量。我们提出了一种缓存感知和Enclave感知的操作语义来帮助严格建立CC的安全属性，并通过实验证明了CC能够在适度的性能和复杂性影响下挫败对缓存的旁路攻击。
The security of isolated execution architectures such as Intel SGX has been significantly threatened by the recent emer-gence of side-channel attacks. Cache side-channel attacks allow adversaries to leak secrets stored inside isolated enclaves without having direct access to the enclave memory. In some cases, secrets can be leaked even without having the knowledge of the victim application code or having OS-level privileges. We propose the concept of Composable Cachelets (CC), a new scalable strategy to dynamically partition the last-level cache (LLC) for completely isolating enclaves from other applications and from each other. CC supports enclave isolation in caches with the capability to dynamically readjust the cache capacity as enclaves are created and destroyed. We present a cache-aware and enclave-aware operational semantics to help rigorously establish security properties of CC, and we experimentally demonstrate that CC thwarts side-channel attacks on caches with modest performance and complexity impact.