{'fraction_non_alphanumeric': 0.020995800839832032, 'fraction_numerical': 0.0, 'mean_word_length': 5.415384615384616, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Verifying the Security of Enclaved Execution Against Interrupt-based Side-channel Attacks

Computing platforms sometimes provide hardware support for enclaves or trusted execution environments. On such platforms, security critical code can execute in an enclave or secure world, isolated from all other software on the platform. But the past few years, several successful side-channel attacks have been developed that break, or at least significantly weaken the isolation that these mechanisms offer. Particularly dangerous are software-based side-channels, as they can be launched even without physical access to the computing platform. These attacks often exploit architectural or micro-architectural features of the platform, like caches, paging, speculative execution, or interrupts. Extending a platform with new features, brings a risk of introducing new such side-channel attacks. In this talk, we will discuss an approach to formally prove the security of platform extensions against these side-channel attacks, and instantiate that approach in a simple setting. More specifically, we will consider the concrete case of extending a microprocessor that supports enclaved execution with support for securely interrupting these enclaves. The base platform we start from is the Sancus system. We show how making enclaves interruptible can lead to new side-channel attacks that weaken the isolation properties of enclaves. We then discuss how to formalize security against such attacks, and discuss the design and implementation of an interrupt handling mechanism for Sancus that is provably secure in the sense that it does not introduce new side-channel attacks.