Abstract:Intel software-guard extensions (SGX) allows applications to run in a trusted space (enclave), which provides a highly secure primitive for the running codes and data. Most state-of-the-art attacks on SGX either exploit software vulnerabilities in the enclave or utilize side channels. In this study, we propose the first fault injection attack to break SGX by using voltage-induced hardware faults. This attack is completely controlled by software. It does not require the availability of any software vulnerability. Our proposed attack targets multi-core processors where dynamic voltage and frequency scaling (DVFS) is equipped, which covers most of the commercial processors including those by Intel and ARM. We follow the basic principle for frequency and voltage based fault injection attacks which adjust the frequency or voltage levels deliberately to create hardware faults. We have demonstrated that the software-controlled voltage glitches are effective to fault ARM processors in the previous work. However, to the best of our knowledge, this is the first realization of such attacks on SGX. More specifically, we develop a kernel module to schedule frequency and voltage for Intel processors through their model-specific registers (MSR). We firstly utilize the module to furnish the processor a transient low voltage with controlled timing to inject a temporal fault into the target location of the program running on SGX. Then we perform differential fault analysis on the outputs before and after the injection of faults. This allows us to obtain the SGX-protected confidential data such as encryption keys, with which we can access program and data in the enclave or run any application in the enclave. For demonstration, we successfully deploy the proposed attack to extract the key of an AES executed in the SGX enclave.

DVFSspy: Using Dynamic Voltage and Frequency Scaling As a Covert Channel for Multiple Procedures

DVFS as a Security Failure of TrustZone-enabled Heterogeneous SoC

User- and Process-Driven Dynamic Voltage and Frequency Scaling.

Power Reduction Through Measurement and Modeling of Users and CPUs: Summary

User-Driven Frequency Scaling

A Deep Investigation on Stealthy DVFS Fault Injection Attacks at DNN Hardware Accelerators

Noise-Aware DVFS for Efficient Transitions on Battery-Powered IoT Devices

VoltJockey: ABUSING THE PROCESSOR VOLTAGE TO BREAK ARM TrustZone

DF-SCA: Dynamic Frequency Side Channel Attacks are Practical

MagView++: Data Exfiltration Via CPU Magnetic Signals under Video Decoding

Dynamic voltage and frequency scaling circuits with two supply voltages

A power-aware system combining static compiling and DVFS

Exploiting CPU Clock Modulation for Covert Communication Channel

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors

Balancing Security and Efficiency: System-Informed Mitigation of Power-Based Covert Channels

VoltJockey: Breaking SGX by Software-Controlled Voltage-Induced Hardware Faults

VoltJockey: Breaching TrustZone by Software-Controlled Voltage Manipulation over Multi-core Frequencies

Dynamic voltage and frequency scaling based on workload decomposition

VoltJockey: A New Dynamic Voltage Scaling based Fault Injection Attack on Intel SGX

DATE: Defense Against TEmperature Side-Channel Attacks in DVFS Enabled MPSoCs

Dynamic Voltage and Frequency Scaling for Scientific Applications