POSTER: On the Feasibility of Inferring SGX Execution through PMU

Intel SGX is a power technology designed to establish a trusted execution environment on processors. Despite its promising features, there are various potential attack surfaces like the Performance Monitoring Unit (PMU) that could be exploited to extract security-sensitive data from SGX enclaves. To address this security threat, Intel has introduced anti side-channel interface (ASCI) that disables the PMU when an SGX enclave is running. However, little attention has been paid to performing the security evaluation of the ASCI feature, leaving the possibility of reviving such an attack. In this paper, we study if Intel’s ASCI feature truly hides the internal execution state of SGX enclaves from the PMU to completely eliminate PMU-driven attack surfaces. To achieve this, we design a novel framework that investigates the effect of the running enclave on all possible performance monitoring events. The key idea of our framework is to (i) analyze the linearity between the number of instructions executed within an enclave and the corresponding measured events and (ii) perform single-stepping and zero-stepping attacks with performance monitoring events. Our security evaluation demonstrates that SGX enclave does not leave any footprint on PMUs, except for opt-in (i.e., debug) enclave where a hardware-based protection mechanism is not supported.