scholarly journals Bypassing Isolated Execution on RISC-V using Side-Channel-Assisted Fault-Injection and Its Countermeasure

2021 ◽  
pp. 28-68
Author(s):  
Shoei Nashimoto ◽  
Daisuke Suzuki ◽  
Rei Ueno ◽  
Naofumi Homma
Keyword(s):  
Real World ◽  
Fault Injection ◽  
Side Channel ◽  
Proof Of Concept ◽  
Malicious Software ◽  
Memory Protection ◽  
Channel Information ◽  
Execution Environment ◽  
Fault Injection Attack ◽  
Trusted Execution Environment

RISC-V is equipped with physical memory protection (PMP) to prevent malicious software from accessing protected memory regions. PMP provides a trusted execution environment (TEE) that isolates secure and insecure applications. In this study, we propose a side-channel-assisted fault-injection attack to bypass isolation based on PMP. The proposed attack scheme involves extracting successful glitch parameters for fault injection from side-channel information under crossdevice conditions. A proof-of-concept TEE compatible with PMP in RISC-V was implemented, and the feasibility and effectiveness of the proposed attack scheme was validated through experiments in TEEs. The results indicate that an attacker can bypass the isolation of the TEE and read data from the protected memory region In addition, we experimentally demonstrate that the proposed attack applies to a real-world TEE, Keystone. Furthermore, we propose a software-based countermeasure that prevents the proposed attack.

scholarly journals Bluethunder: A 2-level Directional Predictor Based Side-Channel Attack against SGX

2019 ◽  
pp. 321-347
Author(s):  
Tianlin Huo ◽  
Xiaoni Meng ◽  
Wenhao Wang ◽  
Chunliang Hao ◽  
Pei Zhao ◽  
...  
Keyword(s):  
Branch Prediction ◽  
Control Flow ◽  
Side Channel ◽  
Side Channel Attack ◽  
Fine Grained ◽  
Private Key ◽  
High Bandwidth ◽  
Execution Environment ◽  
The Cost ◽  
Trusted Execution Environment

Software Guard Extension (SGX) is a hardware-based trusted execution environment (TEE) implemented in recent Intel commodity processors. By isolating the memory of security-critical applications from untrusted software, this mechanism provides users with a strongly shielded environment called enclave for executing programs safely. However, recent studies have demonstrated that SGX enclaves are vulnerable to side-channel attacks. In order to deal with these attacks, several protection techniques have been studied and utilized.In this paper, we explore a new pattern history table (PHT) based side-channel attack against SGX named Bluethunder, which can bypass existing protection techniques and reveal the secret information inside an enclave. Comparing to existing PHT-based attacks (such as Branchscope [ERAG+18]), Bluethunder abuses the 2-level directional predictor in the branch prediction unit, on top of which we develop an exploitation methodology to disclose the input-dependent control flow in an enclave. Since the cost of training the 2-level predictor is pretty low, Bluethunder can achieve a high bandwidth during the attack. We evaluate our attacks on two case studies: extracting the format string information in the vfprintf function in the Intel SGX SDK and attacking the implementation of RSA decryption algorithm in mbed TLS. Both attacks show that Bluethunder can recover fine-grained information inside an enclave with low training overhead, which outperforms the latest PHT-based side channel attack (Branchscope) by 52×. Specifically, in the second attack, Bluethunder can recover the RSA private key with 96.76% accuracy in a single run.

scholarly journals PDoT

2021 ◽  
Vol 2 (1) ◽  
pp. 1-22
Author(s):  
Yoshimichi Nakatsuka ◽  
Andrew Paverd ◽  
Gene Tsudik
Keyword(s):  
Transport Layer ◽  
Security And Privacy ◽  
The Internet ◽  
Domain Name System ◽  
Proof Of Concept ◽  
Remote Attestation ◽  
Domain Name ◽  
Transport Layer Security ◽  
Execution Environment ◽  
Trusted Execution Environment

Security and privacy of the Internet Domain Name System (DNS) have been longstanding concerns. Recently, there is a trend to protect DNS traffic using Transport Layer Security (TLS). However, at least two major issues remain: (1) How do clients authenticate DNS-over-TLS endpoints in a scalable and extensible manner? and (2) How can clients trust endpoints to behave as expected? In this article, we propose a novel Private DNS-over-TLS (PDoT) architecture. PDoT includes a DNS Recursive Resolver (RecRes) that operates within a Trusted Execution Environment. Using Remote Attestation , DNS clients can authenticate and receive strong assurance of trustworthiness of PDoT RecRes. We provide an open source proof-of-concept implementation of PDoT and experimentally demonstrate that its latency and throughput match that of the popular Unbound DNS-over-TLS resolver.

scholarly journals SoftME: A Software-Based Memory Protection Approach for TEE System to Resist Physical Attacks

2019 ◽  
Vol 2019 ◽  
pp. 1-12 ◽  
Author(s):  
Meiyu Zhang ◽  
Qianying Zhang ◽  
Shijun Zhao ◽  
Zhiping Shi ◽  
Yong Guan
Keyword(s):  
Prototype System ◽  
Sensitive Data ◽  
Embedded Devices ◽  
Memory Space ◽  
Memory Protection ◽  
System Overhead ◽  
Execution Environment ◽  
On Chip ◽  
The Internet Of Things ◽  
Trusted Execution Environment

The development of the Internet of Things has made embedded devices widely used. Embedded devices are often used to process sensitive data, making them the target of attackers. ARM TrustZone technology is used to protect embedded device data from compromised operating systems and applications. But as the value of the data stored in embedded devices increases, more and more effective physical attacks have emerged. However, TrustZone cannot resist physical attacks. We propose SoftME, an approach that utilizes the on-chip memory space to provide a trusted execution environment for sensitive applications. We protect the confidentiality and integrity of the data stored on the off-chip memory. In addition, we design task scheduling in the encryption process. We implement a prototype system of our approach on the development board supporting TrustZone and evaluate the overhead of our approach. The experimental results show that our approach improves the security of the system, and there is no significant increase in system overhead.

scholarly journals Privacy-Preserving Genotype Imputation in a Trusted Execution Environment

2021 ◽  
Author(s):  
Natnatee Dokmai ◽  
Can Kockan ◽  
Kaiyuan Zhu ◽  
XiaoFeng Wang ◽  
S. Cenk Sahinalp ◽  
...  
Keyword(s):  
Large Scale ◽  
Genetic Data ◽  
Privacy Preserving ◽  
Genotype Imputation ◽  
Third Party ◽  
Side Channel ◽  
Data Repositories ◽  
Genetics Research ◽  
Execution Environment ◽  
Trusted Execution Environment

AbstractGenotype imputation is an essential tool in genetics research, whereby missing genotypes are inferred based on a panel of reference genomes to enhance the power of downstream analyses. Recently, public imputation servers have been developed to allow researchers to leverage increasingly large-scale and diverse genetic data repositories for imputation. However, privacy concerns associated with uploading one’s genetic data to a third-party server greatly limit the utility of these services. In this paper, we introduce a practical, secure hardware-based solution for a privacy-preserving imputation service, which keeps the input genomes private from the service provider by processing the data only within a Trusted Execution Environment (TEE) offered by the Intel SGX technology. Our solution features SMac, an efficient, side-channel-resilient imputation algorithm designed for Intel SGX, which employs the hidden Markov model (HMM)-based imputation strategy also utilized by a state-of-the-art imputation software Minimac. SMac achieves imputation accuracies virtually identical to those of Minimac and provides protection against known attacks on SGX while maintaining scalability to large datasets. We additionally show the necessity of our strategies for mitigating side-channel risks by identifying vulnerabilities in existing imputation software and controlling their information exposure. Overall, our work provides a guideline for practical and secure implementation of genetic analysis tools in SGX, representing a step toward privacy-preserving analysis services that can facilitate data sharing and accelerate genetics research.†AvailabilityOur software is available at https://github.com/ndokmai/sgx-genotype-imputation.

scholarly journals Side-channel leakage from sensor-based countermeasures against fault injection attack

2019 ◽  
Vol 90 ◽  
pp. 63-71
Author(s):  
Takeshi Sugawara ◽  
Natsu Shoji ◽  
Kazuo Sakiyama ◽  
Kohei Matsuda ◽  
Noriyuki Miura ◽  
...  
Keyword(s):  
Fault Injection ◽  
Side Channel ◽  
Fault Injection Attack

scholarly journals Attacking TrustZone on devices lacking memory protection

2021 ◽  
Author(s):  
Ron Stajnrod ◽  
Raz Ben Yehuda ◽  
Nezer Jacob Zaidenberg
Keyword(s):  
Memory Protection ◽  
Design And Implementation ◽  
Execution Environment ◽  
Processor Cores ◽  
Trusted Execution Environment

AbstractARM TrustZone offers a Trusted Execution Environment (TEE) embedded into the processor cores. Some vendors offer ARM modules that do not fully comply with TrustZone specifications, which may lead to vulnerabilities in the system. In this paper, we present a DMA attack tutorial from the insecure world onto the secure world, and the design and implementation of this attack in a real insecure hardware.

Towards a Standard for a Reliable Execution Environment for Security Protocols

2016 ◽  
Vol 2 (1) ◽  
pp. 78
Author(s):  
Mahalingam Ramkumar
Keyword(s):  
Information Systems ◽  
Full Advantage ◽  
Real World ◽  
Security Protocols ◽  
Low Complexity ◽  
High Integrity ◽  
Execution Environment ◽  
World Information ◽  
Digital Assets ◽  
Attack Models

Approaches for securing digital assets of information systems can be classified as active approaches based on attack models, and passive approaches based on system-models. Passive approaches are inherently superior to active ones. However, taking full advantage of passive approaches calls for a rigorous standard for a low-complexity-high-integrity execution environment for security protocols. We sketch broad outlines of mirror network (MN) modules, as a candidate for such a standard. Their utility in assuring real-world information systems is illustrated with examples.

Sign in / Sign up

Export Citation Format

Share Document