A Proactive Defense Strategy Against SGX Side-channel Attacks via self-checking DRL in the Cloud

Abstract

Intel software guard extensions (SGX) technology allows cloud vendors to provide customers with an independent and trusted execution environment (TEE). It protects critical data confidentiality and integrity from malicious software. However, more and more SGX side-channel attacks have appeared, which seriously undermine the confidence of tenants in cloud security. The related research focuses on system hardware and SGX compiler solutions for specific attacks, which also has difficulties in deployment. Differently, we propose an intelligent-driven proactive defense strategy, which is based on live migration. To the best of our knowledge, this is the first proactive defense against SGX side-channel attacks. We adopt the Markov decision process to solve the migration programming problem. The innovative deep reinforcement learning (DRL) solves problems of the unknown state transition probability and large machine load states, which is called self-checking proximal policy optimization (SPPO). It changes the reward pattern, improving the convergence speed and stability of DRL. In prototype experiments, we deploy the strategy in the OpenStack platform agilely to prove the defense performance and low virtual machine costs.