Sanctorum: A lightweight Security Monitor for Secure Enclaves
Ilia Lebedev1,a, Kyle Hogan1,b, Jules Drean1,c, David Kohlbrenner2,e, Dayeol Lee2,f, Krste Asanović2,g, Dawn Song2,h and Srinivas Devadas1,d
1CSAIL, MIT, Cambridge, MA, USA
ailebedev@csail.mit.edu
bklhogan@csail.mit.edu
cdrean@csail.mit.edu
ddevadas@csail.mit.edu
2EECS, UC Berkeley, Berkeley, CA, USA
edkohlbre@berkeley.edu
fdayeol@berkeley.edu
gkrste@berkeley.edu
hdawnsong@berkeley.edu
ABSTRACT
Enclaves have emerged as a particularly compelling primitive to implement trusted execution environments: strongly isolated sensitive user-mode processes in a largely untrusted software environment. While the threat models employed by various enclave systems differ, the high-level guarantees they offer are essentially the same: attestation of an enclave’s initial state, as well as a guarantee of enclave integrity and privacy in the presence of an adversary. This work describes Sanctorum, a small trusted code base (TCB), consisting of a generic enclave-capable system, which is sufficient to implement secure enclaves akin to the primitive offered by Intel's SGX. While enclaves may be implemented via unconditionally trusted hardware and microcode, as it is the case in SGX, we employ a smaller TCB principally consisting of authenticated, privileged software, which may be replaced or patched as needed. Sanctorum implements a formally verified specification for generic enclaves on an in-order multiprocessor system meeting baseline security requirements, e.g., the MIT Sanctum processor and the Keystone enclave framework. Sanctorum requires trustworthy hardware including a random number generator, a private cryptographic key pair derived via a secure bootstrapping protocol, and a robust isolation primitive to safeguard sensitive information. Sanctorum's threat model is informed by the threat model of the isolation primitive, and is suitable for adding enclaves to a variety of processor systems.
Keywords: Trusted execution, Enclave, Secure processor
