Introduction to SGX (Software Guard Extensions) and SGX Virtualization. Kai Huang, Jun Nakajima (Speaker) July 12, 2017

Size: px

Start display at page:

Download "Introduction to SGX (Software Guard Extensions) and SGX Virtualization. Kai Huang, Jun Nakajima (Speaker) July 12, 2017"

Claire Stone
5 years ago
Views:

1 Introduction to SGX (Software Guard Extensions) and SGX Virtualization Kai Huang, Jun Nakajima (Speaker) July 12, INTEL RESTRICTED SECRET

2 Agenda SGX Introduction Xen SGX Virtualization Support Backup 2 INTEL RESTRICTED SECRET

3 SGX: Reduce TCB to HW + Enclave Attack Surface Today Attack Surface with Enclave App App App App Enclave OS VMM Hardware OS VMM Hardware Enclave: A protected container in App s address space (ring 3). Even privileged SW cannot access enclave directly. Reduce TCB to HW + Enclave è App gets its own capability of protection 3 INTEL RESTRICTED SECRET

4 SGX: Prevent Memory Snooping Attacks Security perimeter is the CPU package boundary Data and code unencrypted inside CPU package CPU MEE Memory Bus System Memory jco3lks937w Data outside CPU package is encrypted and/or integrity checked External memory reads and bus snooping only see encrypted data Snoop Snoop *MEE: SGX Memory Encryption Engine 4 INTEL RESTRICTED SECRET

5 SGX Enclave Enclave Trusted Execution Environment embedded in application Provides confidentiality and/or integrity With it s own code/data. With controlled entry points Multiple threads supported EPC (Enclave Page Cache) Trusted Memory to commit enclave (via page table) OS Enclave APP stack APP code Enclave stack Enclave heap Enclave code Page table mapping With additional access check Typically reserved by BIOS as Processor Reserved Memory Memory EPC EPCM Along with EPCM with limited size (ex, 32M, 64M, 128M) New SGX instructions to manage/access Enclave 5 INTEL RESTRICTED SECRET ENCLS, ENCLU. * EPCM (Enclave Page Cache Map) : Used by HW to track EPC status (not-visible to SW)

6 Instruction Behavior Changes in Enclave Invalid Instructions Behavior Changes RDTSC, RDTSCP: Only legal when SGX2 is available. RDRAND, RDSEED, PAUSE: May cause VMEXIT INVD: #UD in enclave INT3 6 INTEL RESTRICTED SECRET

7 SGX Application Flow 1. Define and partition App to untrusted and trusted part. 2. App creates enclave 3. Trusted function is called; 4. Code in enclave process secrets. 5. Trusted function returns. 6. App continues normal execution. 2. Create enclave 3. CallTrusted () 6. Cont 1. Partition SGX App Call Bridge 4. Process secrets 5. Return Trusted part (Enclave) Untrusted part OS, VMM, BIOS, SMM, 7 INTEL RESTRICTED SECRET

8 Agenda SGX Introduction Xen SGX Virtualization Support Backup 8 INTEL RESTRICTED SECRET

9 Virtualizing SGX General Enabling Pretty Straightforward Discover SGX and Manage EPC in Hypervisor Expose part of the host EPC to guest Size: configurable from user Base: calculated internally SGX CPUID/MSR emulation Setup EPT mapping for guest EPC and host EPC. ENCLS and ENCLU runs perfectly in non-root mode. EPC Virtualization Approaches Static Partitioning Oversubscription Ballooning 9 INTEL RESTRICTED SECRET

10 SGX Interaction with VMX New ENCLS VMEXIT New bit in secondary exec control to enable ENCLS VMEXIT New 64-bit bitmap to control which ENCLS leaves will trigger VMEXIT New bits to indicate whether VMEXIT (any) is from Enclave Bit 27 in exit_reason Bit 4 in GUEST_INTERRUPTBILITY_INFO. 10 INTEL RESTRICTED SECRET

11 Xen SGX Virtualization Support Dom0 HVM SGX App SGX App XL Tools memory = 1024 epc = 64M Enclave Enclave Notify - EPC base - EPC size SGX driver Guest EPC Kernel * EPT Violation * ENCLS Emulation ACPI/CPUID/MSR EPT mapping Populate EPC EPT Violation handler ENCLS Emulation handler Exposing EPC EPC Management Host EPC Xen Hypervisor Changes * ENCLS emulation & EPT violation may not needed, depending on implementation of EPC virtualization 11 INTEL RESTRICTED SECRET

12 EPC Virtualization Approaches (3) Pros Cons Static Partitioning Easy implementation (no ENCLS trapping/emulation, No EPT violation) No hypervisor overhead Ballooning Pros of static partitioning More efficient use of EPC Potential inefficient use of EPC Require ballooning driver in guest Oversubscription More efficient use of EPC Complicated implementation Higher hypervisor overhead We have preliminary patches on github with static partitioning implemented. Oversubscription vs Ballooning? 12 INTEL RESTRICTED SECRET

13 Questions? 13 INTEL RESTRICTED SECRET

Intel Software Guard Extensions

Intel Software Guard Extensions Dr. Matthias Hahn, Intel Deutschland GmbH July 12 th 2017 cryptovision Mindshare, Gelsenkirchen Intel SGX Making Headlines Premium Content requiring Intel SGX on PC Intel