TEEshift: Protecting Code Confidentiality by Selectively Shifting Functions into TEEs

Abstract

We present TEEshift, a tool suite that protects the confidentiality and integrity of code by shifting selected functions into TEEs. Our approach works entirely on binary-level and does not require the adaption of source code projects or build environments, nor does it require compiler-level patches. Programmers provide a list of ELF symbols pointing to the functions that should be protected. After post-processing an ELF binary with TEEshift, the selected functions are not present in cleartext anymore. Only after attesting to a remote party that the loading enclave behaves with integrity, the functions are decrypted, but remain inside the enclave protected against reverse engineering. An online connection is only required when a program starts for the first time on a PC. Afterwards, sealing is used to securely store the decryption key and bind it to the PC. By allowing programmers to move selected function into TEEs, without patching their source code, we provide a convenient way to enable TEEs in existing projects while preserving the flexibility for a finegrained security and performance tradeoff. Moving all functions into a TEE would decrease the runtime performance of a program notably, but by selecting only a few functions, e.g., choosing licensing or DRM functionality worth protecting, a program’s overall performance can be preserved. For example, we evaluated our tool using a real world gaming application, confirming the practicability of our approach for existing projects. We overcome the limitation of the fragmented TEE landscape by building on top of Asylo, an open framework by Google for apps which aim to support different TEEs such as Intel SGX and AMD SEV using a unified API.

Paper: TEEshift (by Titouan Lazard, Johannes Götzfried, Tilo Müller, Gianni Santinelli, and Vincent Lefebvre)
Slides: TEEshift Slides (presented at SysTEX’18, Toronto, Ontario, Canada)

Get the Code

Implementation (by Titouan Lazard):
TEEshift at GitHub