Aurora: Providing Trusted System Services for Enclaves On an Untrusted System

Abstract

Intel SGX provisions shielded executions for security-sensitive computation, but lacks support for trusted system services (TSS), such as clock, network and filesystem. This makes \textit{enclaves} vulnerable to Iago attacks~\cite{DBLP:conf/asplos/CheckowayS13} in the face of a powerful malicious system. To mitigate this problem, we present Aurora, a novel architecture that provides TSSes via a secure channel between enclaves and devices on top of an untrusted system, and implement two types of TSSes, i.e. clock and end-to-end network. We evaluate our solution by porting SQLite and OpenSSL into Aurora, experimental results show that SQLite benefits from a \textit{microsecond} accuracy trusted clock and OpenSSL gains end-to-end secure network with about 1ms overhead.

arXiv commentTrusted Computing, Intel SGX, SMM

References in corpus (5)

• SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Execution
• SGXIO: Generic Trusted I/O Path for Intel SGX
• FreeGuard: A Faster Secure Heap Allocator
• Building Critical Applications using Microservices
• SafeKeeper: Protecting Web Passwords using Trusted Execution Environments

Cited by in corpus (5)

• AI-Enhanced Resilience in Power Systems: Adversarial Deep Learning for Robust Short-Term Voltage Stability Assessment under Cyber-Attacks
• End-to-End Security for Distributed Event-Driven Enclave Applications on Heterogeneous TEEs
• Customizing Trusted AI Accelerators for Efficient Privacy-Preserving Machine Learning
• SGX-SSD: A Policy-based Versioning SSD with Intel SGX
• A Policy-based Versioning SSD with Intel SGX