论文标题
斯特拉：稀疏的污点分析用于飞地泄漏检测
STELLA: Sparse Taint Analysis for Enclave Leakage Detection
论文作者
论文摘要
英特尔SGX（软件防护扩展）是一种有前途的T恤（可信执行环境）技术，可以保护在用户空间中运行的程序免于被主机操作系统访问。尽管它提供了硬件访问控制和内存加密，但实际有效性也取决于软件的质量。特别是，由于使用指针的使用无效，在飞地内运行的代码段的实现不当仍可能泄漏私人数据。本文是研究飞地代码的隐私泄漏问题的首次尝试，并提出了一种新颖的静态稀疏污点分析方法来检测它们。我们首先总结了五种常见的泄漏代码模式。基于这些模式，我们的方法执行了前瞻性分析，以识别所有污点的水槽，然后采用向后检测泄漏的方法。最后，我们对几个开源飞地计划进行了实验，发现78个漏洞以前在13个项目中未知。
Intel SGX (Software Guard Extension) is a promising TEE (trusted execution environment) technique that can protect programs running in user space from being maliciously accessed by the host operating system. Although it provides hardware access control and memory encryption, the actual effectiveness also depends on the quality of the software. In particular, improper implementation of a code snippet running inside the enclave may still leak private data due to the invalid use of pointers. This paper serves as a first attempt to study the privacy leakage issues of enclave code and proposes a novel static sparse taint analysis approach to detect them. We first summarize five common patterns of leakage code. Based on these patterns, our approach performs forward analysis to recognize all taint sinks and then employs a backward approach to detect leakages. Finally, we have conducted experiments with several open-source enclave programs and found 78 vulnerabilities previously unknown in 13 projects.
