Making Your Program Oblivious: A Comparative Study for Side-channel-Safe Confidential Computing

Trusted Execution Environments (TEEs) are gradually adopted by major cloud providers, offering a practical option of confidential computing for users who do not fully trust public clouds. TEEs use CPU -enabled hardware features to eliminate direct breaches from compromised operating systems or hypervisors. However, recent studies have shown that side-channel attacks are still effective on TEEs. An appealing solution is to convert applications to be data oblivious to deter many side-channel attacks. While a few research prototypes on TEEs have adopted specific data oblivious operations, the general conversion approaches have never been thoroughly compared against and tested on benchmark TEE applications. These limitations make it difficult for researchers and practitioners to choose and adopt a suitable data oblivious approach. To address these issues, we conduct a comprehensive analysis of representative conversion approaches and perform an extensive empirical study to provide insights into their performance and ease of use with benchmark TEE applications.