\HeadingLevelA{A Survey of Secure Processors}
\label{sec:sgx_related}

This section describes the broad landscape of trusted hardware projects in cursory terms. Table~\ref{fig:secure_processors} summarizes the security
properties of SGX and the other trusted hardware presented here.

\begin{sidewaystable}[tbp]
\centering
\caption{Security features overview for the trusted hardware projects related to Intel's SGX.}
\label{fig:secure_processors}
\begin{scriptsize}
\begin{tabular}{|>{\bf}p{0.9in}"*{5}{p{1.035in}|}}
\hline
\textbf{Attack} &
\textbf{TrustZone} &
\textbf{TPM} &
\textbf{TPM+TXT} &
\textbf{SGX} &
\textbf{XOM} \\
\thickhline

Malicious containers\linebreak(direct probing) &
N/A (secure world is trusted)&
N/A (The whole computer is one container)&
N/A (Does not allow concurrent containers)&
Access checks on TLB misses&
Identifier tag checks \\
\hline

Malicious OS (direct probing) &
Access checks on TLB misses &
N/A (OS measured and trusted) &
Host OS preempted during late launch &
Access checks on TLB misses &
OS has its own identifier \\
\hline

Malicious hypervisor\linebreak(direct probing) &
Access checks on TLB misses &
N/A (Hypervisor measured and trusted) &
Hypervisor preempted during late launch &
Access checks on TLB misses &
N/A (No hypervisor support) \\
\hline

Malicious firmware &
N/A (firmware is a part of the secure world) &
CPU microcode measures PEI firmware &
SINIT ACM signed by Intel key and measured &
SMM handler is subject to TLB access checks &
N/A (Firmware is not active after booting) \\
\hline

Malicious containers\linebreak(cache timing) &
N/A (secure world is trusted) &
N/A (Does not allow concurrent containers) &
N/A (Does not allow concurrent containers) &
$\times$ &
$\times$ \\
\hline

Malicious OS\linebreak(page fault recording) &
Secure world has own page tables &
N/A (OS measured and trusted) &
Host OS preempted during late launch &
$\times$ &
N/A (Paging not supported) \\
\hline

Malicious OS\linebreak(cache timing) &
$\times$ &
N/A (OS measured and trusted) &
Host OS preempted during late launch &
$\times$ &
$\times$ \\
\hline

DMA from malicious peripheral &
On-chip bus bounces secure world accesses &
$\times$ &
IOMMU bounces DMA into TXT memory range &
IOMMU bounces DMA into PRM &
Equivalent to physical DRAM access \\
\hline

Physical DRAM read &
Secure world limited to on-chip SRAM &
$\times$ &
$\times$ &
Undocumented memory encryption engine &
DRAM encryption \\
\hline

Physical DRAM write &
Secure world limited to on-chip SRAM &
$\times$ &
$\times$ &
Undocumented memory encryption engine &
HMAC of address and data \\
\hline

Physical DRAM rollback write &
Secure world limited to on-chip SRAM &
$\times$ &
$\times$ &
Undocumented memory encryption engine &
$\times$ \\
\hline

Physical DRAM address reads &
Secure world in on-chip SRAM &
$\times$ &
$\times$ &
$\times$ &
$\times$ \\
\thickhline

Hardware TCB size &
CPU chip package &
Motherboard (CPU, TPM, DRAM, buses) &
Motherboard (CPU, TPM, DRAM, buses) &
CPU chip package &
CPU chip package \\
\hline

Software TCB size &
Secure world (firmware, OS, application) &
All software on the computer &
SINIT ACM + VM (OS, application) &
Application module + privileged module + containers &
Application module + hypervisor \\
\hline
\end{tabular}%
\end{scriptsize}
\end{sidewaystable}

\begin{sidewaystable}[tbp]
\ContinuedFloat
\captionsetup{list=off,format=cont}
\centering
\caption{Security features overview for the trusted hardware projects related to Intel's SGX.}
\begin{scriptsize}
\begin{tabular}{|>{\bf}p{0.9in}"*{4}{p{1.035in}|}}
\hline
\textbf{Attack} &
\textbf{Aegis} &
\textbf{Bastion} &
\textbf{Ascend, Phantom} &
\textbf{Sanctum} \\
\thickhline

Malicious containers\linebreak(direct probing) &
Security kernel separates containers &
Access checks on each memory access &
OS separates containers &
Access checks on TLB misses \\
\hline

Malicious OS (direct probing) &
Security kernel measured and isolated &
Memory encryption and HMAC &
$\times$ &
Access checks on TLB misses \\
\hline

Malicious hypervisor\linebreak(direct probing) &
N/A (No hypervisor support) &
Hypervisor measured and trusted &
N/A (No hypervisor support) &
Access checks on TLB misses \\
\hline

Malicious firmware &
N/A (Firmware is not active after booting) &
Hypervisor measured after boot &
N/A (Firmware is not active after booting) &
Firmware is measured and trusted \\
\hline

Malicious containers\linebreak(cache timing) &
$\times$ &
$\times$ &
$\times$ &
Each enclave its gets own cache partition \\
\hline

Malicious OS\linebreak(page fault recording) &
$\times$ &
$\times$ &
$\times$ &
Per-enclave page tables \\
\hline

Malicious OS\linebreak(cache timing) &
$\times$ &
$\times$ &
$\times$ &
Non-enclave software uses a separate cache partition \\
\hline

DMA from malicious peripheral &
Equivalent to physical DRAM access &
Equivalent to physical DRAM access &
Equivalent to physical DRAM access &
MC bounces DMA outside allowed range \\
\hline

Physical DRAM read &
DRAM encryption &
DRAM encryption &
DRAM encryption &
$\times$ \\
\hline

Physical DRAM write &
HMAC of address, data, timestamp &
Merkle tree over DRAM &
HMAC of address, data, timestamp &
$\times$ \\
\hline

Physical DRAM rollback write &
Merkle tree over HMAC timestamps &
Merkle tree over DRAM &
Merkle tree over HMAC timestamps &
$\times$ \\
\hline

Physical DRAM address reads &
$\times$ &
$\times$ &
ORAM &
$\times$ \\
\thickhline

Hardware TCB size &
CPU chip package &
CPU chip package &
CPU chip package &
CPU chip package \\
\hline

Software TCB size &
Application module + security kernel &
Application module + hypervisor &
Application process + trusted OS &
Application module + security monitor \\
\hline

\end{tabular}%
\end{scriptsize}
\end{sidewaystable}

\input{text/survey/ibm4764.tex}

\input{text/survey/trustzone.tex}

\input{text/survey/xom.tex}

\input{text/survey/tpm.tex}

\input{text/survey/intel_txt.tex}

\input{text/survey/aegis.tex}

\input{text/survey/bastion.tex}

\input{text/survey/intel_sgx.tex}

\input{text/survey/sanctum.tex}

\input{text/survey/ascend.tex}
