Detecting and handling attacks on processes executing within a trusted execution environment
Systems and methods for detecting and handling attacks on processes executing within a trusted execution environment (TEE) are disclosed. In one implementation, a processing device may detect by a first process an event indicating that a first process executing in a TEE of a host computer system is under attack from a second process executing on the host computer system. the processing device may set a flag within a memory region of the TEE indicating that the first process is under attack. The processing device may further perform, in view of an attack response policy associated with the first process, an action responsive to detecting the event.
1. A method, comprising:
detecting, by a first process executing in a trusted execution environment (TEE) of a host computer system, an event indicating that the first process is under an attack from a second process executing on the host computer system;
setting, by the first process, a flag within a memory region of the TEE indicating that the first process is under the attack, wherein the set flag enables at least the first process to reject an attempt to restart itself after the first process has been terminated;
notifying, by the first process, other processes running within the TEE that the first process is under the attack, wherein the other processes take measures to mitigate the attack; and
performing, by the first process and in view of an attack response policy associated with the first process, an action responsive to detecting the event.
2. The method of claim 1 , wherein the first process is an infrastructure process executing at the TEE.
3. The method of claim 2 , wherein the flag is associated with the infrastructure process executing at the TEE.
4. The method of claim 1 , wherein the first process is a software application executing within an infrastructure system.
5. The method of claim 4 , wherein setting the flag comprises sending a request to the infrastructure system to set the flag.
6. The method of claim 4 , wherein the software application is to send one or more network packets as a notification of the attack to the other processes running within the TEE.
7. The method of claim 1 , wherein the action comprises at least one of: terminating execution of the first process, sending a notification, storing data and exiting, exiting after a predetermined wait time, or declining to restart the first process.
8. The method of claim 1 , wherein the event comprises at least one of:
exceeding a threshold delay in executing a command by the first process,
an unexpected return value from an operation executed by fest the first process, or
an exit command to a host that is rejected by the host.
9. The method of claim 1 , wherein the attack response policy is one of a plurality of attack response policies associated with the first process, and wherein the attack response policy is selected based on a severity of the attack of the second process.
10. The method of claim 1 , wherein the flag is accessible to the other processes executing at the TEE.
11. A system comprising:
a memory; and
a processor operatively coupled to the memory, wherein the processor is further to:
detect an event indicating that a software application running within an infrastructure system deployed to a host computer system is under an attack from a process executing on the host computer system, wherein the infrastructure system is executing in a trusted execution environment (TEE) of the host computer system;
send a request to the infrastructure system to set a flag within a memory region of the TEE indicating that the software application is under the attack, wherein the set flag enables at least the software application to reject an attempt to restart itself after the software application has been terminated;
send a notification to other applications executing within the infrastructure system indicating the attack from the process, wherein the other applications take measures to mitigate the attack; and
perform, in view of an attack response policy associated with the software application, an action responsive to detecting the event.
12. The system of claim 11 , wherein to send the notification, the processor is to send one or more network packets via a network interface device to a predetermined destination, the one or more network packets comprising information related to the attack.
13. The system of claim 11 , wherein the action comprises at least one of: terminating execution of the software application, storing data then exiting, exiting after a predetermined wait time, or declining to restart the software application.
14. The system of claim 11 , wherein the event comprises at least one of:
exceeding a threshold delay in executing a command by the software application,
an unexpected return value from an operation executed by the software application, or
an exit command to a host that is rejected by the host.
15. The system of claim 11 , wherein the attack response policy is one of a plurality of attack response policies associated with the software application, and wherein the attack response policy is selected based on a severity of the attack of the process.
16. A non-transitory computer-readable storage medium comprising executable instructions that, when executed by a processing device, cause the processing device to:
detect an event indicating that a first process executing in a trusted execution environment (TEE) of a host computer system is under an attack from a second process executing on the host computer system;
set a flag within a memory region of the TEE indicating that the first process is under the attack, wherein the set flag enables at least the first process to reject an attempt to restart itself after the first process has been terminated;
notify other processes running within the TEE that the first process is under the attack, wherein the other processes take measures to mitigate the attack; and
perform, in view of an attack response policy associated with the first process, an action responsive to detecting the event.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the first process is an infrastructure process executing at the TEE, and wherein the flag is associated with the infrastructure process executing at the TEE.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the first process is a software application executing within an infrastructure system, and wherein to set the flag, the processing device is to send a request to the infrastructure system to set the flag.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the action comprises at least one of: terminating execution of the first process, sending a notification, storing data then exiting, exiting after a predetermined wait time, or declining to restart the first process.
20. The non-transitory computer-readable storage medium of claim 16 , wherein the event comprises at least one of:
exceeding a threshold delay in executing a command by the first process,
an unexpected return value from an operation executed by the first process, or
an exit command to a host that is rejected by the host.