topic Intel SGX doesn't trust the in Intel® Software Guard Extensions (Intel® SGX)

EPC protection

Meysam_t_ — Fri, 23 Jun 2017 23:07:40 GMT

Hi folks,

Do you know how SGX makes EPC invisible to OS? I know that there is an ownership mechanism using labels for different enclaves to make sure every enclave is accessing just to its own page inside the EPC; is there a similar mechanism for OS as well? it seems SGX needs more to prevent the adversary OS from EPC?

thanks

Meysam

Intel SGX doesn't trust the

yunfeng7854 — Sat, 24 Jun 2017 13:14:46 GMT

Intel SGX doesn't trust the OS, so it maintains the EPCM to support page permission check for EPC pages. The security check is performed by extending the page miss handler (PMH).

Please refer to https://eprint.iacr.org/2016/086.pdf, page 93, Sec. 6.2 for more details.