obfuscuro: a commodity obfuscation engine for intel sgx · 2020-08-03 · obfuscuro: a commodity...

OBFUSCURO: A Commodity Obfuscation Engine for Intel SGX

Adil Ahmad*, Byunggill Joe*, Yuan Xiao

Yinqian Zhang, Insik Shin, Byoungyoung Lee

(* denotes equal contribution)

Program Obfuscation

Program Obfuscation

𝑷𝒑𝒓𝒊𝒗

Trusted Untrusted (except the Black box)

Sender’s Goal Protect the internals of private program 𝑷𝒑𝒓𝒊𝒗

Program Obfuscation


EncryptionEngine



Program Obfuscation


EncryptionEngine


Attacker chooses inputs𝐼0 𝐼1 𝐼𝑁…



Program Obfuscation


EncryptionEngine

UntrustedSystem




Blackbox


Program Obfuscation


EncryptionEngine

UntrustedSystem




Blackbox


Receiver’s Goal Disclose the internals

of program 𝑷𝒑𝒓𝒊𝒗

Program Obfuscation


EncryptionEngine

UntrustedSystem




Blackbox

If the black box is “secure”?




Program Obfuscation

Output


EncryptionEngine

UntrustedSystem



After constant time 𝑻


Blackbox





Program Obfuscation

Output


EncryptionEngine

UntrustedSystem

Observable execution traces𝑷𝒑𝒓𝒊𝒗


Φ0 Φ1 Φ𝑁…

After constant time 𝑻


Blackbox





Execution traces should not leak information about 𝑷𝒑𝒓𝒊𝒗

Wait, isn’t that what Intel SGX does?

3

Wait, isn’t that what Intel SGX does?Program

3


Non-Enclave

Enclave

3


Non-Enclave

Enclave

Confidentiality and integrityguarantees

Trusted executionregion

3


Non-Enclave

Enclave

Operating System (and other untrusted software)

Restricted by the processor

Confidentiality and integrityguarantees

Trusted executionregion

3

4

Intel SGX is not perfect!

4

Enclave


4

Enclave

Memory accessedby the enclave


4

Enclave


Access Frame #0 0x1000

Page Tablecache-set 0

cache-set 3

CPU CacheTaken Address

0 0x1000

Branch Target Buffer


Visible traces on untrusted/shared components!

Timing

4

Enclave




cache-set 3


0 0x1000



Operating System


Granularity: 4KB (1 page)

Timing

4

Enclave




cache-set 3


0 0x1000



Operating System



Granularity: 64B (1 line)

Timing

4

Enclave




cache-set 3


0 0x1000



Operating System



Granularity: Jmp address


Timing

4

Enclave




cache-set 3


0 0x1000



Operating System





Timing

Granularity: Execution Time

4

Enclave



Page Table

Paging, Branch-prediction and Cache attacks![S&P14, SEC17, ASPLOS18, DIMVA17, WOOT17]

cache-set 0

cache-set 3


0 0x1000



Operating System





Timing

Granularity: Execution Time

Learning from existing solutions!

5


5

Access patterns attacks!

Transactional Memory

[NDSS17, SEC17]


5


Possible Soln.

Incomplete


[NDSS17, SEC17]


5


Possible Soln.

Incomplete ring-0 required

Cache Partitioning

[SEC18]


[NDSS17, SEC17]


5


Possible Soln.

Incomplete ring-0 required Insecure

Cache Partitioning

[SEC18]

Address Randomization

[NDSS17]


[NDSS17, SEC17]


5

Lesson #1 Ring-3 enclaves cannot hide access

patterns through side-channels!


Possible Soln.


Cache Partitioning

[SEC18]


[NDSS17]


[NDSS17, SEC17]


5



Access patterns attacks! Timing attacks!

Possible Soln.


Cache Partitioning

[SEC18]


[NDSS17]


[NDSS17, SEC17]RDTSC


5




OS-controllable

Possible Soln.Possible Soln.


Cache Partitioning

[SEC18]


[NDSS17]



Networktimers


5




OS-controllable OS-controllable



Cache Partitioning

[SEC18]


[NDSS17]



Networktimers

Threadtimers


5




OS-controllable OS-controllable OS-controllable



Cache Partitioning

[SEC18]


[NDSS17]



Networktimers

Threadtimers


5



Lesson #2Unreliable timers for SGX

enclaves!


OS-controllable OS-controllable OS-controllable



Cache Partitioning

[SEC18]


[NDSS17]

Our approach

6

Our approach

6

• Indistinguishable enclave program(s)

Our approach

6

• Indistinguishable enclave program(s)• A code block executed N times on C-Pad, and data block accessed from D-Pad

Our approach

6


• C-Pad and D-Pad are one cache-line (64B) in size!

Our approach

6



C-Pad

64B

D-Pad

64B

# of executions: 0

Our approach

6



C-Pad

64B

D-Pad

64B

Single data access

# of executions: 0

Our approach

6



C-Pad

64B

D-Pad

64B

Branch to the start of C-Pad Single data

access

# of executions: 01

Our approach

6



C-Pad

64B

D-Pad

64B


access

# of executions: 01N

Our approach

6



C-Pad

64B

D-Pad

64B


access

What do the attacks reveal?# of executions: 01N

Our approach

6



C-Pad

64B

D-Pad

64B


access

What do the attacks reveal?

Paging Attack: Same page


Our approach

6



C-Pad

64B

D-Pad

64B


access


Cache Attack: Same cache-lines



Our approach

6



C-Pad

64B

D-Pad

64B


access



Branch Attack: Same branch



Our approach

6



C-Pad

64B

D-Pad

64B


access





Timing Attack: Same time to execute N code blocks


Our approach

6



C-Pad

64B

D-Pad

64B


access





Timing Attack: Same time to execute N code blocks

# of executions: 01N Instead of trying to hide traces, all enclaves should leak the same traces!

Let Hermione explain!

7


𝑬𝒏𝒄𝒍𝒂𝒗𝒆𝟏

𝑬𝒏𝒄𝒍𝒂𝒗𝒆𝟐

Operating System

7




Operating System

Pat

tern

Pat

tern

Before(Native)

7




Operating System

Pat

tern

Pat

tern

Before(Native)

Obfuscuro

7




Operating System

Pat

tern

Pat

tern

Before(Native)

After(Obfuscuro)

Obfuscuro

7

Cool, what’s the challenge?

8


8

• Naïve solution• Use a software-translator to copy all code and data onto C/D-Pad


8

C-Pad

64B

Enclave Storage


Foo

Bar

Main

Translator

D-Pad

64B


8

C-Pad

64B

Enclave Storage


Foo

Bar

Main

56B

78B

67B

Translator

C1. Native code is not in 64B blocks!

D-Pad

64B


8

C-Pad

64B

Enclave Storage


Foo

Bar

Main

56B

78B

67B

Translator


C2. Access patterns leaked while copying!

D-Pad

64B

FooBar


8

C-Pad

64B

Enclave Storage


Foo

Bar

Main

56B

78B

67B

Translator



Foojmpjmp

Barjmp

C3. Code can havedifferent branches!

D-Pad

64B

FooBar


8

C-Pad

64B

Enclave Storage


Foo

Bar

Main

56B

78B

67B

Translator



Foojmpjmp

Barjmp

C3. Code can havedifferent branches!

C4. Timing issues not even discussed!

D-Pad

64B

FooBar

Obfuscuro

• Program obfuscation on Intel SGX• All programs should exhibit same patterns irrespective of logic/input.

• Adapted from Harry Potter spell “Obscuro” (translation :> Darkness)

9

Code Controller

Data Controller

stash

pos. map

D-Tree

C-Pad

64B

D-Pad

64B

stash

pos. map

ORAM BankC-Tree

Code execution model

Data access model

C1. Enforce code blocks of identical sizes

10


10

• Break code blocks into 64 bytes and pad using nop


10


Foo()

Native

90B


10


Foo()

Native

ObfuscuroCompiler90B


10


Foo()

Native


Foo.1()

Instrumented

64B

NOPs 38 bytes

26 bytes64B

64 bytes

Foo.2()Split Foo()


10


Foo()

Native


Foo.1()

Instrumented

64B

NOPs 38 bytes

26 bytes64B

64 bytes

Foo.2()Split Foo()

64B (single cache-line) code blocks can be loaded onto the C-Pad!

C2. Securely loading C/D-Pad

11


11

• Fetch code and data using Oblivious RAM (ORAM)• The code and data is fetched onto C-Pad and D-Pad resp.


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map

1

Execute old code block


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map

Request new code block

2

1



11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


2

1


Retrieve the blockusing ORAM

3


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


2

1



3

Instrumented code is located in C-Tree


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


2

1


Update C-Pad withnew code block

4


3


Foo.1


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


2

1



4


3

Execute new code block

5


Foo.1


11


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


2

1



4


3

Execute new code block

5


Foo.1

Side-channel-resistant ORAM scheme ensuresno leakage as C/D-Pad are loaded!

C3. Align branches to/from C-Pad

12


12

• Each instrumented code block has two branches to fixed locations• C-Pad Code-Controller

• C-Pad Data-Controller


12


• C-Pad Data-Controller Code execution model

Data access model

C-Pad

jmp

jmp

Data Controller

stash

pos. map

Code Controller

stash

pos. map

addsub imul

CPU-boundinstructions


12



Data access model

C-Pad

jmp

jmp

Data Controller

stash

pos. map

Code Controller

stash

pos. map

Src. A Dst. A

addsub imul


Dst. BSrc. B

FixedDst. Addr.

Fixed Src. Addr.


12



Data access model

C-Pad

jmp

jmp

Data Controller

stash

pos. map

Code Controller

stash

pos. map

Src. A Dst. A

addsub imul


Dst. BSrc. B

FixedDst. Addr.

Fixed Src. Addr.

C/D-Controller have no conditional

branches!


12



Data access model

C-Pad

jmp

jmp

Data Controller

stash

pos. map

Code Controller

stash

pos. map

Src. A Dst. A

addsub imul


Dst. BSrc. B

FixedDst. Addr.

Fixed Src. Addr.

C/D-Controller have no conditional

branches!

All Obfuscuro programs execute the same sequence of branches!

C4. Ensuring execution time consistency

13


13

• The program executes fixed number of code blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map

Request next code block

1

Contains dummy but indistinguishable code

blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


1

2

Retrieve thenext block


blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


1

3

2

Return to C-Pad Retrieve thenext block


blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


1

3

2

Term

Return to C-Pad Retrieve thenext block

After N blocks


blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


1

3

2

Term 4

Return to C-Pad

Fetches output and exits enclave!


After N blocks


blocks


13


ORAM Bank

C-TreeC-Pad

64B

Code Controller

stash

pos. map


1

3

2

Term 4

Return to C-Pad

Fetches output and exits enclave!


After N blocks

Execute N code blocks to ensure all programs terminate consistently!

Faster memory store for enclaves

14


14

• Use AVX registers as store instead of ”Oblivious” store

DRAM

CPU


AVX registers

14


C-Pad

64B

Code Controller

stash

pos. map

DRAM

CPU


DRAM-based store

AVX registers

Have to sequentiallyaccess all memory indices

14


C-Pad

64B

Code Controller

stash

pos. map

DRAM

CPU


DRAM-based store

Register-based store

AVX registers


Can access individualregisters obliviously!

14


C-Pad

64B

Code Controller

stash

pos. map

DRAM

CPU


DRAM-based store

Register-based store

AVX registers


Can access individualregisters obliviously!

14


C-Pad

64B

Code Controller

stash

pos. map

AVX registers can be used as a faster, oblivious storage for SGX enclaves!

Implementation

15

Implementation

15

• LLVM compiler suite (3117 LoC)• Breaks all code into similar blocks (C1)

• Instrument and align all control and data-flow instructions (C3)

Implementation

15



• Runtime library (2179 LoC)• Initializes ORAM trees and performs secure ORAM operations (C2)

• Terminate program and fetch output (C4)

Implementation

15



• Runtime library (2179 LoC)• Initializes ORAM trees and performs secure ORAM operations (C2)

• Terminate program and fetch output (C4)

• Intel SGX SDK (25 LoC)• Assign memory regions for C/D-Pad (support)

Performance Evaluation

16

0

100

200

300

16 2768 85 121

231O

verh

ead

(ti

me

s)

Programs


16

0

100

200

300

16 2768 85 121

231O

verh

ead

(ti

me

s)

Programs

We ported ~10 simple applications to

Obfuscuro!


16

0

100

200

300

16 2768 85 121

231O

verh

ead

(ti

me

s)

Programs

Average overhead observed is 81 times over

native programs!


Obfuscuro!


16

0

100

200

300

16 2768 85 121

231O

verh

ead

(ti

me

s)

Programs

Average overhead observed is 81 times over

native programs!

The overhead is highly dependent on input size

and program type!


Obfuscuro!

Ending Remarks!

17

Ending Remarks!

17

1. Program obfuscation is a remarkable dream to achieve

Ending Remarks!

17


2. Various software/hardware limitations hinder the realization of program obfuscation on Intel SGX

Ending Remarks!

17



3. Existing solutions have a limited approach towards side-channel mitigation in Intel SGX

Ending Remarks!

17



3. Existing solutions have a limited approach towards side-channel mitigation in Intel SGX

4. Obfuscuro is compiler-based scheme which addresses this issue by ensuring all programs leak same access patterns

Adil AhmadContact: [email protected]

18(Translation ~ Thanks!) ;)

Execution Time Evaluation

19

cycl

es

Code block with instructionsof each type

General programs

ORAM access time dominates the time of code block execution!

obfuscuro: a commodity obfuscation engine for intel sgx · 2020-08-03 · obfuscuro: a commodity...

Documents