PRIDWEN: Universally Hardening SGX Programs via Load-Time Synthesis
summary
PRIDWEN is a load-time loader that probes remote platform features, decides an optimal set of side‑channel mitigations, and synthesizes a native binary from a WebAssembly IR inside an SGX enclave. It supports hardware-assisted (TSX) and software-only defenses, detects missing features to avoid faults, and validates enforcement. Overhead for first-time synthesis is about 50–500 ms; runtime slowdowns match existing mitigations (≈1.9× for hardware, ≈3.4× for software), and the prototype is open source.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:24Existing Security Solutions
- 2:16Intel SGX 101
- 4:12Achilles' Heel of SGX: Side-Channel Attacks
- 5:19Side Channel Mitigation Schemes
- 5:56Deployment of a Mitigation Scheme
- 6:44Composing Multiple Mitigation Schemes
- 7:24Problems with Naïve Scheme Composition
- 8:40Post-Deployment Scheme Enforcement
- 9:46PRIDWEN Overview
- 12:11Selective Enforcement of Schemes
- 12:46Use IR as Input
- 14:33Flexible Instrumentation
- 15:05PRIDWEN Instrumentation APIs
- 16:36Evaluation: Overhead of PRIDWEN Loader
- 17:14Evaluation: Baseline Runtime Performance
- 18:00Evaluation: Overhead of Mitigation Schemes
- 18:21Conclusion
related talks
29mWASM in the Kernel: evolving threat detection at runtime
01h 28m“Spectre: Secrets, Side-Channels, Sandboxes, and Security”
56mSpectre/C++
23mThe Guard's Dilemma: Efficient Code-Reuse Attacks Against Intel SGX
18mHardware-Software Codesign for Mitigating Spectre
15mAccelerating Encrypted Deduplication via SGX
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves
46mRIDLed with CPU bugs