\HeadingLevelB{Security Analysis of Sanctum}
\label{sec:security_analysis}

Sanctum's security argument rests on two pillars: the enclave isolation
enforced by the security monitor, and the guarantees behind the software
attestation signature. This section outlines correctness arguments for each of
these pillars.

Sanctum's isolation primitives protect enclaves from outside software that
attempts to observe or interact with the enclave software via means outside the
interface provided by the security monitor. Sanctum prevents direct attacks by
ensuring that the memory owned by an enclave can only be accessed by that
enclave's software. More subtle attacks are foiled by also isolating the structures
used to access the enclave's memory, such as the enclave's page tables and the
caches that hold enclave data, and by sanitizing hardware structures updated by
enclave execution, such as the cores' branch prediction tables. Attacks exploiting
DMA-capable devices on the system bus are thwarted by whitelisting a region of physical
addresses where DMA accesses are permitted, and the DRAM controller timing channel is closed
by either expecting the OS to exclusively grant DRAM banks to enclaves
(this is evident during attestation), or by implementing a DRAM controller
with a constant expected access latency.

\input{text/sanctum/analysis/direct_memory_attacks.tex}

\input{text/sanctum/analysis/subtle_attacks.tex}

\input{text/sanctum/analysis/os_protection.tex}

\input{text/sanctum/analysis/monitor_protection.tex}

\input{text/sanctum/analysis/attestation.tex}
