  Security architectures providing Trusted Execution Environments (TEEs) have
been an appealing research subject for a wide range of computer systems, from
low-end embedded devices to powerful cloud servers. The goal of these
architectures is to protect sensitive services in isolated execution contexts,
called enclaves. Unfortunately, existing TEE solutions suffer from significant
design shortcomings. First, they follow a one-size-fits-all approach offering
only a single enclave type, however, different services need flexible enclaves
that can adjust to their demands. Second, they cannot efficiently support
emerging applications (e.g., Machine Learning as a Service), which require
secure channels to peripherals (e.g., accelerators), or the computational power
of multiple cores. Third, their protection against cache side-channel attacks
is either an afterthought or impractical, i.e., no fine-grained mapping between
cache resources and individual enclaves is provided.
  In this work, we propose CURE, the first security architecture, which tackles
these design challenges by providing different types of enclaves: (i) sub-space
enclaves provide vertical isolation at all execution privilege levels, (ii)
user-space enclaves provide isolated execution to unprivileged applications,
and (iii) self-contained enclaves allow isolated execution environments that
span multiple privilege levels. Moreover, CURE enables the exclusive assignment
of system resources, e.g., peripherals, CPU cores, or cache resources to single
enclaves. CURE requires minimal hardware changes while significantly improving
the state of the art of hardware-assisted security architectures. We
implemented CURE on a RISC-V-based SoC and thoroughly evaluated our prototype
in terms of hardware and performance overhead. CURE imposes a geometric mean
performance overhead of 15.33% on standard benchmarks.
