PaperlayerView exact revision on arXiv

Source-linked AI summary

An Off-Chip Attack on Hardware Enclaves via the Memory Bus

Dayeol Lee, Dongha Jung, Ian T. Fang, Chia-Che Tsai, Raluca Ada Popa

arXiv:1912.01701v1cs.CR

TL;DR

MEMBUSTER addresses the problem of enclave confidentiality despite encrypted data by snooping unencrypted off-chip memory addresses. It combines techniques to expose useful accesses and match traces to secrets; on an SGX machine, the authors report accuracy similar to controlled-channel attacks with much lower overhead.

  • Problem

    Enclave data may be encrypted while unencrypted memory-bus addresses remain observable, and on-chip protections do not prevent this off-chip channel.

    Source: §1 · pp. 1–2

  • Method

    MEMBUSTER uses critical page whitelisting, cache squeezing, and oracle-based fuzzy matching to expose useful memory accesses and identify sensitive accesses in traces.

    Source: §1 · p. 2

  • Results

    The attack achieved similar accuracy with much lower overhead than previous attacks such as controlled-channel attacks on an actual SGX machine.

    Source: §9 · p. 15

  • Takeaways & Limitations

    The conclusion identifies MEMBUSTER as a fine-grained physical side channel and says the technique may apply beyond Intel SGX to other secure processors.

    Source: §9 · p. 15

    Cache squeezing may be less effective when the victim has few critical addresses or a small memory footprint.

    Source: §5.4.3 · p. 9

Abstract

from arXiv · show

This paper shows how an attacker can break the confidentiality of a hardware enclave with Membuster, an off-chip attack based on snooping the memory bus. An attacker with physical access can observe an unencrypted address bus and extract fine-grained memory access patterns of the victim. Membuster is qualitatively different from prior on-chip attacks to enclaves and is more difficult to thwart. We highlight several challenges for Membuster. First, DRAM requests are only visible on the memory bus at last-level cache misses. Second, the attack needs to incur minimal interference or overhead to the victim to prevent the detection of the attack. Lastly, the attacker needs to reverse-engineer the translation between virtual, physical, and DRAM addresses to perform a robust attack. We introduce three techniques, critical page whitelisting, cache squeezing, and oracle-based fuzzy matching algorithm to increase cache misses for memory accesses that are useful for the attack, with no detectable interference to the victim, and to convert memory accesses to sensitive data. We demonstrate Membuster on an Intel SGX CPU to leak confidential data from two applications: Hunspell and Memcached. We show that a single uninterrupted run of the victim can leak most of the sensitive data with high accuracy.

1 Introduction

MEMBUSTER uses physical access to snoop unencrypted memory-bus addresses, exposing enclave access patterns despite encrypted data. The paper develops techniques to make useful accesses observable and recover secrets, then demonstrates the attack on an Intel SGX system.

1 Introduction

  • MEMBUSTER observes unencrypted addresses directly on the off-chip memory bus, a channel existing on-chip defenses do not protect.The paper contrasts this with attacks using shared on-chip components or adversarial memory management.Source: §1 · pp. 1–2, Figure 1 · p. 1
  • Prior studies had suggested memory-address-bus attacks, but had not shown one breaking enclave confidentiality.The paper presents MEMBUSTER as such an attack.Source: §1 · p. 2
  • Existing protected-access defenses do not stop off-chip address observation; proposed alternatives include oblivious execution, ORAM, or address-bus encryption.The paper notes that oblivious algorithms and ORAM impose significant performance overhead, while bus encryption requires CPU and DRAM changes.Source: §1 · p. 2
  • Robust attacks must solve address translation, sparse DRAM visibility at cache misses, and unusual SGX memory behaviors.The paper notes that disabling the cache does not work in SGX and paging hides most memory accesses.Source: §1 · p. 2
  • Critical page whitelisting, cache squeezing, and oracle-based fuzzy matching increase useful cache misses and map noisy traces to sensitive accesses.The authors say these techniques avoid detectable victim interference and can be combined with cache priming.Source: §1 · p. 2
  • The evaluation captures bus signals from a production SGX-enabled Intel system and demonstrates the attack on Hunspell and Memcached.The authors also simulate the attack in modified QEMU to examine scalability.Source: §1 · p. 2

2 Background and Related Work

The background introduces hardware enclaves and explains Intel SGX's trust boundary and protected memory. SGX encrypts enclave data in external memory, while treating off-chip devices as potentially compromised.

2 Background and Related Work

  • Hardware enclaves protect sensitive code and data under a model that trusts the processor package but not external components.The paper selects SGX as its target because of its mature implementation and threat model against untrusted DRAM.Source: §2.1 · p. 2

MEMBUSTER

MEMBUSTER targets the unencrypted address bus of SGX systems, where enclave data may be encrypted but addresses remain visible. The section contrasts this channel with existing on-chip attacks and defenses.

MEMBUSTER

  • SGX encrypts and authenticates enclave data in the EPC, but does not encrypt memory-bus addresses.The paper notes that address encryption would require changes involving DRAM-side decryption.Source: MEMBUSTER · p. 3

2.2.1 Side Channel Attacks on SGX

  • Earlier SGX side channels use shared caches, page faults, or page-table activity, with differing noise, loss, and victim interference.PRIME+PROBE may be noisy and lossy; controlled-channel attacks are noiseless and lossless but incur page faults.Source: §2.2.1 · p. 3

2.2.2 Advantages of MEMBUSTER

  • MEMBUSTER filters non-victim accesses and observes cache-line-granularity accesses without AEXs or page faults.The authors state it does not require order-of-magnitude overhead.Source: §2.2.2 · p. 3
  • On-chip countermeasures such as cache partitioning and defenses against AEXs or page faults do not reliably mitigate direct off-chip observation.The paper says existing on-chip measures provide no reliable way to detect or mitigate MEMBUSTER.Source: §2.2.2 · p. 4

2.2.3 Related Work

  • DRAMA infers access to shared DRAM rows from latency, whereas MEMBUSTER directly uses the address bus as a side channel.Source: §2.2.3 · p. 4

3 MEMBUSTER

MEMBUSTER collects DRAM signals with physical access, reconstructs DRAM and virtual addresses, and analyzes traces offline. The attack relies on hardware-specific reverse engineering and a modified SGX driver for address mappings.

3.1 Threat Model

  • The threat model requires physical access and knowledge of the victim application and runtime; advanced techniques may also require root privileges.The attacker may install a modified SGX driver, and the assumed access rules out remote attacks.Source: §3.1 · p. 4

3.2 Hardware Setup for the Attack

  • A DIMM interposer duplicates command-bus signals for analysis, and its sampling rate and recording capacity constrain trace capture.The paper states that sampling must match or exceed the DIMM clock rate and gives an example acquisition window of about 14 seconds for 64 GiB at DDR4-2400.Source: §3.2 · pp. 4–5, Figure 2 · p. 4

3.3 Interpreting DRAM Commands

  • The attacker interprets DRAM commands to reconstruct timestamped read and write traces with rank, bank, row, and column information.The method tracks the activated row within each bank.Source: §3.3 · p. 5

3.4 Reverse-engineering DRAM Addressing

  • Because address mapping depends on hardware, the authors probe EPC cache lines to derive physical-to-DRAM mappings for the i5-8400.Other CPU models may use different mappings, so reverse engineering must be repeated per model.Source: §3.4 · pp. 5–6, Figure 3 · p. 6

3.5 Translating PA to VA

  • The attack translates physical addresses to virtual addresses using mappings retrieved through a modified SGX driver.The authors calibrate paging timings from the dmesg log against trace timestamps and report translating all physical addresses to virtual addresses.Source: §3.5 · p. 6

4 Attack Examples

The paper illustrates MEMBUSTER against Hunspell spell-checking of a confidential document and Memcached indexing emails. The examples exploit address patterns from Hunspell lookups and Memcached hash-table searches.

4.1 Hunspell

  • Hunspell’s add_word() and lookup() reveal the searched word’s hash bucket and the preceding linked-list nodes accessed before it is found.The example assumes the attacker knows the document language and can obtain the same public dictionary.Source: §4.1 · p. 6
  • MEMBUSTER observes cache-line addresses for individual Hunspell nodes, providing finer-grained access patterns than controlled-channel attacks’ page-address sequences.This granularity can expose sensitive information even when caching partially obscures access patterns.Source: §4.1 · p. 7

4.2 Memcached

  • In the Memcached scenario, an attacker injects an email and uses memory-bus observations to try to reveal the victim’s secret emails A, B, and C.The index data is assumed to reside in Memcached running inside an SGX enclave.Source: §4.2 · p. 7
  • Although Memcached has no data-dependent control flow, its Murmur3-indexed hash-table accesses expose the hash of a searched key through the accessed address.The attacker first locates the dynamically allocated hash table using an injected email containing a known word and hash.Source: §4.2 · p. 7
  • After observing query hashes, the attacker maps them to words using precomputed natural-word hashes and chooses common words when hashes conflict.The paper reports that this approach can recover most words.Source: §4.2 · p. 7

5 Increasing Critical Cache Misses

The attack needs more observable cache misses on addresses useful for recovering secrets, without detectable victim interference. The section develops page pinning and cache manipulation techniques to target those addresses.

5.1 Can We Disable Caching?

  • Because MTRR and PAT cannot change SGX PRM cacheability, disabling caching would require a BIOS change and cause detectable slowdown.PRMRR is writable only by BIOS during boot; the authors therefore reject disabling cacheability as an attack strategy.Source: §5.1 · p. 8

5.2 Critical Page Whitelisting

  • Paging hides accesses to swapped pages and changes virtual-to-physical mappings, so the modified SGX driver pins EPC pages for critical address ranges.For Hunspell, the critical malloc() range is 5,604 KB; pinned pages are never swapped out.Source: §5.2 · p. 8

5.3 Priming the Cache

  • Cross-core priming evicts critical LLC lines without victim synchronization, whereas page-fault priming adds detectable interference and is excluded.Priming all sets can be too slow; the authors later narrow priming to targeted sets. Page-fault priming every 10–20 faults incurs about 3× overhead.Source: §5.3 · pp. 8–9

5.4.1 Cache Squeezing

  • Cache squeezing maps critical pages into a small set of conflict groups, inducing LLC conflict and capacity misses using the victim’s own accesses.The OS controls only higher set-index bits, so the smallest conflict group shares 64 sets; Hunspell’s 5,604 KB critical range requires two groups in the experiment.Source: §5.4.1 · p. 9

5.4.2 Cross-Core Priming with Cache Squeezing

  • Combining squeezing with cross-core priming limits eviction work to the critical conflict-group sets, allowing priming within a millisecond without affecting execution beyond cache contention.The targeted sets contain W × 4 KB per group, and priming can run in parallel.Source: §5.4.2 · p. 9

5.4.3 Limitation

  • Squeezing may be less effective for small critical footprints; Memcached’s 500 critical pages are supplemented with 248 frequently accessed pages to fill a 748-page group.The authors note that reverse-engineering the CPU’s cache-slicing function could further reduce effective cache space, but leave it outside this paper.Source: §5.4.3 · p. 9

5.4.4 Implementation

  • A modified SGX driver implements page whitelisting and squeezing by mapping critical pages from a conflict queue and evicting only non-critical pages.The driver uses separate conflict and loaded-page lists; its application-specific critical ranges are hard-coded, and it supports one victim enclave at a time.Source: §5.4.4 · p. 10

6 Extracting Sensitive Access Patterns

Memory-bus traces remain noisy and omit many critical accesses, so MEMBUSTER analyzes them offline against an application-behavior oracle. It combines access-pattern matching with cache-prefetch knowledge to recover likely sensitive patterns.

6 Extracting Sensitive Access Patterns

  • The attacker must analyze noisy traces offline because critical accesses are missing and the bus trace lacks iteration markers.The paper identifies offline simulation, locating the start of sensitive accesses, fuzzy matching, and cache-prefetch exploitation as analysis techniques.Source: §6 · p. 10

6.1 Offline Simulation

  • Offline simulation generates a deterministic oracle for a target application using publicly available data, such as Hunspell’s en_US dictionary.The authors assume only a finite number of English dictionaries exist; oracle addresses can be shifted to accommodate enclave ASLR.Source: §6.1 · p. 10

6.2 Searching Sensitive Accesses

  • For Hunspell, the start of sensitive accesses is located by matching monotonically increasing node-allocation addresses to the oracle’s dictionary-order sequence.The longest increasing subsequence marks the end of that sequence; the next critical access begins the sensitive range.Source: §6.2 · pp. 10–11

6.3 Fuzzy Pattern Matching

  • Fuzzy matching ranks oracle patterns that fit partial traces, since caching prevents many sensitive accesses from appearing on the bus.An address may fit multiple patterns because nodes are reused in traversals or share cache lines; higher scores favor matches closer to tree leaves or list ends.Source: §6.3 · p. 11

6.4 Exploiting Cache Prefetching

  • Knowledge of next-line and spatial prefetching expands each secret’s matching range by 64 bytes in both directions, capturing prefetched lines that may appear on the bus.The paper distinguishes these prefetchers from stream prefetching, which can increase cache pressure but generally does not improve matching accuracy.Source: §6.4 · p. 11

7 Evaluation

The evaluation is organized around attack accuracy, technique effects, victim interference, limitations, and sensitivity to LLC size. It compares a basic attack with cache-squeezing and cache-squeezing-plus-priming variants.

Evaluation scope

  • The evaluation uses the two vulnerable applications described earlier in the paper.Source: §7 · p. 11

Evaluation questions

  • The evaluation asks how accurately MEMBUSTER extracts secrets and how its techniques affect accuracy and victim slowdown or interference.It also examines attack limitations and sensitivity to the target CPU’s LLC size.Source: §7 · p. 11

Attack settings

  • The evaluation compares three settings: no optimization, cache squeezing, and cache squeezing combined with cross-core cache priming.Source: §7 · p. 11

7.1 Experiment Setup

The evaluation combines physical SGX experiments with software simulations, then applies Membuster to Hunspell and Memcached workloads. The setup tests whether recorded traces can support recovery of document words and cached email terms.

7.1 Experiment Setup

  • The study evaluates Membuster with both physical and simulated experiments.The physical setup uses an Intel SGX machine, a DIMM interposer, and a signal analyzer; the modified QEMU simulator supports preliminary exploration and cross-validation.Source: §7.1 · p. 11, §7.1.1 · p. 11, §7.1.2 · p. 12

7.1.1 Physical Experiment

  • Each physical setting was run only once because access to the proprietary analyzer was limited.The authors report that the physical results matched expectations from simulation.Source: §7.1.1 · p. 12

7.1.2 Microarchitectural Simulation

  • The QEMU simulation traces guest physical accesses and uses an integrated cache simulator, but omits cycle accuracy, cache slicing, and pseudo-LRU replacement.The authors report that it was sufficiently faithful for developing attack scripts to analyze real traces.Source: §7.1.2 · p. 12

7.1.3 Enclave Simulation

  • The enclave simulation models entry, exit, asynchronous exits, and EPC paging, replacing page swap-and-re-encryption instructions with memory copies.The authors compare simulated and real-enclave traces and report identical results.Source: §7.1.3 · p. 12

7.1.4 Applications: Hunspell

  • Hunspell v1.6.2 is tested on a 10,000-word random document and the 39,342-word Wizard of Oz, normalized to the en_US dictionary.The setup disables affix detection and does not recover words Hunspell reports as misspelled.Source: §7.1.4 · p. 12

7.1.5 Application: Memcached

  • Memcached v1.5.12 is tested with Enron email data: roughly 7,000 unique word entries and test emails totaling around 1,000 words.The attacker uses training traces to identify hash-table addresses and values, then monitors an enclave-protected server processing email requests.Source: §7.1.5 · p. 12

7.2 Effectiveness of the Attack

Membuster recovers substantial data from both non-repetitive and high-interval workloads, while repetitive access patterns are harder to recover. The evaluation also reports victim overhead and simulated performance as cache associativity increases.

7.2.1 Data Recovery Accuracy

  • Cache squeezing recovers 96% of Random and 82% of Memcached data; adding cross-core priming raises Wizard recovery to 85%, or 95% excluding stopwords.Without techniques, recovery is 44% for Random and 34% for Memcached; Wizard reaches at most 21% with None or cache squeezing alone.Source: §7.2.1 · p. 13
  • Wizard’s repeated words limit recovery: each unique word occurs 15.5 times on average, and cache squeezing recovers about 2.6 occurrences per word.Without cache squeezing or cross-core priming, the attack recovers about 0.3 occurrences per word on average; repeated accesses are likely to remain in the LLC.Source: §7.2.1 · p. 13

7.2.3 Scalability on # of Ways

  • At W = 64, simulation recovers 83% of Random and 88% of Memcached; at W = 256, recovery is 77% and 40%, respectively, with cache squeezing and priming.The attack is more scalable on Hunspell than Memcached; Figure 10 presents the simulation results.Source: Figure 10 · p. 13, §7.2.3 · p. 14

7.2.2 Overhead and Interference

  • For Hunspell, cache squeezing adds up to 21% execution overhead, rising to 36% with cross-core priming; basic Memcached attacks add none, while squeezing reduces its execution time by 8%.The authors attribute Hunspell’s overhead mainly to increased cache misses; on physical Memcached, critical-page whitelisting reduces average LLC miss rate from 3.6% to 2.9%.Source: §7.2.2 · p. 13

7.3 Per-Application Detailed Analysis

The application analyses examine how prefetching can add useful traces for Hunspell and how fine-grained addresses improve Memcached recovery relative to page-granularity observations.

7.3.1 Hunspell: Advantage of Cache Prefetching

  • For Hunspell, including prefetched addresses increases useful traces per word and particularly improves recovery when the attack otherwise has few traces, though the measured improvement is marginal.The attacker must know that hardware prefetchers are present to correlate prefetched addresses with words.Source: §7.3.1 · p. 14

7.3.2 Memcached: Advantage of Fine-Grained Addresses

  • A simulated page-granularity Memcached attack achieves only 29% accuracy and produces an uninterpretable document, whereas fine-grained addresses provide more side-channel information.The page-granularity simulation masks the lower 12 address bits and maps each resulting address to multiple hash-table entries.Source: §7.3.2 · p. 14

8 Discussion

The discussion bounds Membuster’s effectiveness by which memory accesses reach the bus and considers its implications, platform reach, and possible mitigations. Several attack extensions and multi-device settings remain unexplored.

Limitations

  • Membuster observes only LLC misses, making frequent repeated accesses difficult to recover; data-dependent loads over large regions are a better fit than small or unevenly accessed regions.Secret-dependent stores are also challenging because dirty-line write-back can be delayed until eviction, making bus-request timing unpredictable.Source: §8 · p. 14

Timing Information and Traffic Analysis

  • Timing attacks and traffic analysis are potential extensions, but their demonstrations are left for future work.The analyzer records precise timestamps, and the authors discuss request timing and traffic volume or density as possible signals.Source: §8 · p. 14

Multiple DIMMs or Multi-Socket

  • The current attack does not evaluate multiple DIMMs or CPU sockets; the authors suggest that multiple interposers could be correlated using timestamps or common patterns.The discussion notes that multi-socket SGX is not currently supported.Source: §8 · p. 15

Memory Controllers

  • Memory-controller reordering does not stop leakage in the authors’ analysis because its window is tens of bus cycles, while critical accesses occur at least every hundreds of instructions.Reordered transactions still eventually expose critical addresses on the bus.Source: §8 · p. 15

Generalization

  • Other enclave platforms without memory-bus address encryption are also vulnerable, though available cache-squeezing approaches differ by platform.Komodo permits OS-influenced virtual mapping for cache squeezing; Keystone instead offers cache partitioning to reduce the enclave’s effective cache size.Source: §8 · p. 15

Mitigations and Implications

  • Potential defenses include ORAM, address-bus encryption, and in-package memory, but the authors characterize these alternatives as costly or performance-intensive.The discussion also identifies physical security as important and proposes separating physical access from administrative privileges in secure-cloud settings.Source: §8 · p. 15

9 Conclusion

Membuster snoops memory-bus address lines to attack hardware enclaves, inducing cache misses with minimal performance overhead. On an actual SGX machine, it achieved similar accuracy with much lower overhead than prior attacks such as controlled-channel attacks.

9 Conclusion

  • Membuster achieved similar accuracy with much lower overhead than previous attacks such as controlled-channel attacks on an actual SGX machine.The conclusion reports a demonstration on actual SGX hardware.Source: §9 · p. 15
  • Membuster exploits OS privileges to induce cache misses with minimal performance overhead, reverse-engineers hardware components, and retrieves application secrets from memory-bus traces.Source: §9 · p. 15
  • The authors believe Membuster may apply beyond Intel SGX to secure processors or enclave platforms that do not protect memory buses.Source: §9 · p. 15
Loading 1912.01701v1…