Sanctorum: A lightweight security monitor for secure enclaves
Name
sanctorum.pdf
Description
Accepted version
Size
384.85 KB
Format
Adobe PDF
Checksum (MD5)
51eebc0f76dacf86203d9d43f7ea978c
Author(s)
Lebedev, Ilia A.
Hogan, Kyle
Drean, Jules
Kohlbrenner, David
Lee, Dayeol
Asanovic, Krste
Song, Dawn
Devadas, Srinivas
Date Issued
May 2019
Journal
2019 Design, Automation & Test in Europe Conference & Exhibition (DATE)
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Citation
Lebedev, Ilia et al. "Sanctorum: A lightweight security monitor for secure enclaves." 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE), March 2019, Florence, Italy, Institute of Electrical and Electronics Engineers, May 2019 © 2019 EDAA
Version
Author's final manuscript
Abstract
Enclaves have emerged as a particularly compelling primitive to implement trusted execution environments: strongly isolated sensitive user-mode processes in a largely untrusted software environment. While the threat models employed by various enclave systems differ, the high-level guarantees they offer are essentially the same: attestation of an enclave's initial state, as well as a guarantee of enclave integrity and privacy in the presence of an adversary.This work describes Sanctorum, a small trusted code base (TCB), consisting of a generic enclave-capable system, which is sufficient to implement secure enclaves akin to the primitive offered by Intel's SGX. While enclaves may be implemented via unconditionally trusted hardware and microcode, as it is the case in SGX, we employ a smaller TCB principally consisting of authenticated, privileged software, which may be replaced or patched as needed. Sanctorum implements a formally verified specification for generic enclaves on an in-order multiprocessor system meeting baseline security requirements, e.g., the MIT Sanctum processor and the Keystone enclave framework. Sanctorum requires trustworthy hardware including a random number generator, a private cryptographic key pair derived via a secure bootstrapping protocol, and a robust isolation primitive to safeguard sensitive information. Sanctorum's threat model is informed by the threat model of the isolation primitive, and is suitable for adding enclaves to a variety of processor systems.
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.23919/date.2019.8715182
