Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu

TLDR

Intel SGX protects enclave confidentiality but does not guard against privileged side‑channel attacks, such as page‑fault attacks that let a malicious OS observe memory accesses and infer sensitive data. This work introduces Deja Vu, a framework that lets shielded programs detect privileged side‑channel attacks. Deja Vu embeds path‑level execution‑time checks into the enclave and employs a TSX‑protected software reference clock to provide trustworthy timing. Evaluation demonstrates that Deja Vu reliably detects both enclave‑based and reference‑clock side‑channel attacks.

Abstract

Intel Software Guard Extension (SGX) protects the confidentiality and integrity of an unprivileged program running inside a secure enclave from a privileged attacker who has full control of the entire operating system (OS). Program execution inside this enclave is therefore referred to as shielded. Unfortunately, shielded execution does not protect programs from side-channel attacks by a privileged attacker. For instance, it has been shown that by changing page table entries of memory pages used by shielded execution, a malicious OS kernel could observe memory page accesses from the execution and hence infer a wide range of sensitive information about it. In fact, this page-fault side channel is only an instance of a category of side-channel attacks, here called privileged side-channel attacks, in which privileged attackers frequently preempt the shielded execution to obtain fine-grained side-channel observations. In this paper, we present Deja Vu, a software framework that enables a shielded execution to detect such privileged side-channel attacks. Specifically, we build into shielded execution the ability to check program execution time at the granularity of paths in its control-flow graph. To provide a trustworthy source of time measurement, Deja Vu implements a novel software reference clock that is protected by Intel Transactional Synchronization Extensions (TSX), a hardware implementation of transactional memory. Evaluations show that Deja Vu effectively detects side-channel attacks against shielded execution and against the reference clock itself.