Microarchitectural attacks detection mechanism for trusted execution environments

A system for detecting a microarchitectural attack on a trusted execution environment and/or a violation of an expected execution flow of an application running in the trusted execution environment, the system being implemented in a further trusted execution environment running on a same host as the trusted execution environment, the system comprising one or more processors which, alone or in combination, are configured to facilitate execution of the following steps:

• a) implementing a counting thread that increments a counter variable at each cycle of a central processing unit on which the trusted execution environment is running;
• b) loading an eviction set in a transaction, wherein the eviction set corresponds to a cache set used by an operation of the application running in the trusted execution environment such that a transactional abort is received upon the operation being executed;
• c) reading a value of the counting thread upon receiving the transactional abort;
• d) repeating steps b) and c) for a next operation of the application running in the trusted execution environment;
• e) measuring an execution time for the operation based on a difference between the values of the counting thread;
• and
• f) comparing the measured execution time for the operation with an expected execution time to detect one or more variations that indicate the microarchitectural attack and/or the violation of the expected execution flow of the application.

A tangible, non-transitory computer-readable medium having instructions thereon which, upon being executed by one or more processors, alone or in combination, facilitate execution of a method for detecting a microarchitectural attack on a trusted execution environment and/or a violation of an expected execution flow of an application running in the trusted execution environment comprising the following steps:

• a) implementing a counting thread that increments a counter variable at each cycle of a central processing unit on which the trusted execution environment is running;
• b) loading an eviction set in a transaction, wherein the eviction set corresponds to a cache set used by an operation of the application running in the trusted execution environment such that a transactional abort is received upon the operation being executed;
• c) reading a value of the counting thread upon receiving the transactional abort;
• d) repeating steps b) and c) for a next operation of the application running in the trusted execution environment;
• e) measuring an execution time for the operation based on a difference between the values of the counting thread;
• and
• comparing the measured execution time for the operation with an expected execution time to detect one or more variations that indicate the microarchitectural attack and/or the violation of the expected execution flow of the application.