\HeadingLevelB{Security Primitives}

Sanctum uses strong isolation to defeat information leaks. Enclaves that
execute concurrently on different cores are isolated in the last-level cache
(LLC) using a simple partitioning scheme (\S~\ref{sec:dram_regions}). Page
table sharing is prevented via enclaves mapping their own physical memory
via private page tables inaccessible to other software
(\S~\ref{sec:pmh_walker_input}). Core microarchitectural state including
private cache contents, branch history, and TLBs is kept private by the security monitor,
which interposes on each context switch involving an enclave, and sanitizes these structures.

Sanctum's hardware modifications target the DMA master (\S~\ref{sec:dma_master}) and
the interfaces to the last-level cache (LLC) (shown in
Figure~\ref{fig:uncore_changes}), as well as the interfaces between the memory
management unit's (MMU) page walker, the translation lookaside buffers (TLBs),
and the L1 data cache (shown in Figure~\ref{fig:core_changes}).

Sanctum interposes on the interface between the LLC and the core-private caches to
tweak the mapping between physical addresses and LLC sets, so that the
computer's DRAM is split into many equal-sized regions, and the addresses in
each DRAM region use distinct LLC sets (\S~\ref{sec:dram_regions}). Sanctum augments
the interface between the TLBs and the MMU page walker with registers
supporting per-enclave page tables (\S~\ref{sec:pmh_walker_input}), and Sanctum adds
some logic to the interface between the page walker and the L1 cache to provide
a method for constraining a page table to a set of DRAM regions
(\S~\ref{sec:pmh_walker}). Sanctum modifies the DMA master to reject DMA transfers
that fall outside a safe range of memory addresses set by the security monitor
(\S~\ref{sec:dma_master}). Sanctum allows DRAM banks to be exclusively allocated to enclaves,
or it must implements a DRAM controller with constant expected access latency in order to protect
the confidentiality of enclaves' interactions with the DRAM controller.

Sanctum authenticates enclaves using the same principles as earlier secure processors
such as Aegis \citep{suh2003aegis} and SGX.  Each Sanctum processor has an
asymmetric key pair, and a certificate from the manufacturer for its public
key. After an enclave is started, it can obtain an attestation intended to
convince a remote party that it is communicating to that specific enclave
running in a trusted environment. The attestation is a signature chain that
starts at the manufacturer's trusted root key, and ends with a signature that
covers the remote party's challenge nonce, the enclave's measurement (a
cryptographic hash of the enclave's initial state), and a value produced by the
enclave, which is generally used to start a key exchange protocol such as
Diffie-Hellman \citep{diffie1976keyexchange}.

Sanctum's attestation chain starts with the asymmetric key pair built into the
processor. The next link in the chain is the \textit{measurement root}
(\S~\ref{sec:mroot}), a piece of trusted software that is burned into the
processor's ROM. The measurement root contains the first instructions executed
by a processor after it is powered on or reset, and its main job is to compute
a measurement of the security monitor (a cryptographic hash) and add it to the
attestation chain. The monitor produces enclave attestations.
