\HeadingLevelB{MIT Sanctum Processor}

The Sanctum processor's main contribution is a software isolation scheme that addresses the issues
raised above: Sanctum's isolation provably defends against known software
side-channel attacks, including cache timing attacks and passive address
translation attacks. Sanctum is a co-design that combines \textit{minimal} and
\textit{minimally invasive} hardware modifications with a trusted software
security monitor that is amenable to rigorous analysis and does not
perform cryptographic operations using keys.

Sanctum achieves minimality by reusing and lightly modifying existing,
well-understood mechanisms. For example, Sanctum's per-enclave page tables
implementation uses the core's existing page walking circuit, and requires very
little extra logic. Sanctum is minimally invasive because it does not require
modifying any major CPU building block. It only adds hardware to the interfaces
between blocks, and does not modify any block's input or output. The use of
conventional building blocks limits the effort needed to validate a
Sanctum implementation.

Sanctum demonstrates that memory access pattern attacks by malicious software can be foiled without
incurring unreasonable overheads.
Its hardware changes are small, small enough to
present the added circuits, in their entirety, in Figures
\ref{fig:page_walker_input} and \ref{fig:page_walker_filter}.
Sanctum cores
have the same clock speed as their insecure counterparts, as there are no modifications on
the CPU core critical execution path. Using a straightforward page-coloring-based cache
partitioning scheme with Sanctum adds a few percent of overhead in execution time, which is
orders of magnitude lower than the overheads of the ORAM schemes
\citep{goldreich1987oram, stefanov2013path} that are usually employed to conceal
memory access patterns.

All layers of Sanctum's TCB are open-sourced~\citep{sanctumsource},
and unencumbered by patents,
trade secrets, or other similar intellectual property concerns that would
disincentivize security researchers from analyzing it. The Sanctum prototype targets
the Rocket Chip~\citep{lee2014rocket}, an open-sourced implementation of the
\mbox{RISC-V}~\citep{waterman2014riscv, waterman2015riscvsystem} instruction
set architecture, which is an open standard. Sanctum's software stack
bears the MIT license. % and the authors did not file any patent.

To further encourage analysis, most of Sanctum's security monitor is written in
portable C++ which, once rigorously analyzed, can be used across different CPU
implementations.
%TODO: tricky because requires trust in the compiler to have any rigor?
Furthermore, even the non-portable assembly code can be reused across different
implementations of the same architecture.
In comparison, SGX's microcode is CPU
model-specific, so each micro-architectural revision would require a separate
verification effort.
