Control-flow integrity technology based on the combination of software and hardware

LIANG Hao; HE Benwei; WANG Qingfeng; CHENG Guozhen; MA Hailong

doi:10.11959/j.issn.2096-109x.2024070

您当前的位置：

首页 >

文章列表页 >

Control-flow integrity technology based on the combination of software and hardware

Papers | 更新时间：2024-12-20

- Control-flow integrity technology based on the combination of software and hardware
- Chinese Journal of Network and Information Security Vol. 10, Issue 5, Pages: 107-118(2024)
- 作者机构：
  
  信息工程大学，河南郑州 450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2024070
  CLC： TP311.5
- Received：19 February 2024，
  
  Revised：2024-04-28，
  
  Published：25 October 2024
- 稿件说明：
移动端阅览
梁浩, 何本伟, 王庆丰, 等. 基于软硬件结合的控制流完整性保护技术[J]. 网络与信息安全学报, 2024, 10(5): 107-118.

Format: LIANG H, HE B W, WANG Q F, et al. Control-flow integrity technology based on the combination of software and hardware[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 107-118.
梁浩, 何本伟, 王庆丰, 等. 基于软硬件结合的控制流完整性保护技术[J]. 网络与信息安全学报, 2024, 10(5): 107-118. DOI： 10.11959/j.issn.2096-109x.2024070.

Format: LIANG H, HE B W, WANG Q F, et al. Control-flow integrity technology based on the combination of software and hardware[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 107-118. DOI： 10.11959/j.issn.2096-109x.2024070.

摘要

针对影子栈难以兼顾安全性和性能，软件实现的前向CFI（control-flow integrity）技术性能开销过大、难以进行实际部署，提出基于软硬件结合的CFI（control-flow integrity based on the combination of software and hardware，SHCFI）技术。通过二进制重写器对程序反编译，生成中间语言，并判断转移指令类型。对于后向控制流的保护，提出基于返回地址加密的平行影子栈方案，使用随机数对栈上的返回地址进行异或加密，将加密结果备份到原始栈固定偏移处的影子栈中，在函数返回时对影子栈中的地址异或解密，将解密结果作为实际的返回地址。对于前向控制流的保护，使用硬件ENDBRANCH状态机指令标记间接转移指令的目标地址，在运行时对目标地址进行合法性检查，以降低性能开销。实验结果表明，SHCFI加固后的程序能够有效地防御代码重用攻击，且具有良好的运行开销。

Abstract

For shadow stack

balancing security and performance was difficult

and the forward CFI (control-flow integrity) scheme implemented by software was too expensive and difficult to be deployed in practice. A hybrid CFI scheme based on software and hardware integration

named SHCFI (control-flow integrity based on the combination of software and hardware)

was proposed. Decompilation was undergone by the program using a binary rewriter to generate an intermediate representation

and various transfer instruction types were identified. For the protection of backward control flow

a novel parallel shadow stack scheme was introduced

featuring encrypted return addresses. This involved XOR encryption of return addresses on the stack using random numbers

with the encrypted results stored securely in a shadow stack located at a fixed offset on the original stack. During function returns

addresses in the shadow stack underwent XOR decryption

and the decrypted results served as the actual return addresses. For forward control flow protection

the hardware ENDBRANCH state machine instruction was utilized to mark the target addresses of indirect transfer instructions. At runtime

legitimacy checks were applied to these target addresses

thereby reducing performance overhead. Experimental results demonstrated that programs fortified with SHCFI effectively defended against code reuse attacks

exhibiting favorable runtime overhead.

关键词

Keywords

references

ABADI M , BUDIU M H , ERLINGSSON Ú , et al . Control-flow integrity principles, implementations, and applications [J ] . ACM Transactions on Information and System Security , 2009 , 13 ( 1 ): 4 .

PAPPAS V , POLYCHRONAKIS M , KEROMYTIS A D . Transparent ROP exploit mitigation using indirect branch tracing [C ] // Proceedings of the 22nd USENIX conference on Security . New York : ACM , 2013 : 447 - 462 .

XIA Y B , LIU Y T , CHEN H B , et al . CFIMon: detecting violation of control flow integrity using performance counters [C ] // Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2012) . Piscataway : IEEE Press , 2012 : 1 - 12 .

MASHTIZADEH A J , BITTAU A , BONEH D , et al . CCFI: cryptographically enforced control flow integrity [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2015 : 941 - 951 .

FENG L , HUANG J , HU J , et al . FastCFI: real-time control-flow integrity using FPGA without code instrumentation [J ] . ACM Transactions on Design Automation of Electronic Systems , 2021 , 26 ( 5 ): 39 .

LI J F , CHEN L W , SHI G , et al . ABCFI: fast and lightweight fine-grained hardware-assisted control-flow integrity [J ] . IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2020 , 39 ( 11 ): 3165 - 3176 .

ZHANG J L , QI B H , QIN Z , et al . HCIC: hardware-assisted control-flow integrity checking [J ] . IEEE Internet of Things Journal , 2019 , 6 ( 1 ): 458 - 471 .

SHANBHOGUE V , GUPTA D , SAHITA R . Security analysis of processor instruction set architecture for enforcing control-flow integrity [C ] // Proceedings of the 8th International Workshop on Hardware and Architectural Support for Security and Privacy . New York : ACM , 2019 : 1 - 11 .

ZOU C W , XUE J L . Burn after reading: a shadow stack with microsecond-level runtime rerandomization for protecting return addresses [C ] // Proceedings of the 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE) . Piscataway : IEEE Press , 2020 : 258 - 270 .

LI J F , CHEN L W , XU Q Z , et al . Zipper stack: shadow stacks without shadow [C ] // Proceedings of the Computer Security – ESORICS 2020: 25th European Symposium on Research in Computer Security . New York : ACM , 2020 : 338 - 358 .

ZOU C W , WANG X D , GAO Y Q , et al . Buddy stacks: protecting return addresses with efficient thread-local storage and runtime re-randomization [J ] . ACM Transactions on Software Engineering and Methodology , 2022 , 31 ( 2 ): 35e .

DANG T H Y , MANIATIS P , WAGNER D . The performance cost of shadow stacks and stack canaries [C ] // Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security . New York : ACM , 2015 : 555 - 566 .

BUROW N , ZHANG X P , PAYER M . SoK: shining light on shadow stacks [C ] // Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2019 : 985 - 999 .

黄韬 . 一种绕过平行影子栈的ROP攻击方法的设计与实现 [D ] . 南京 : 南京大学 , 2016 .

HUANG T . The design and implementation of A ROP exploit schema bypassing parallel shadow stack [D ] . Nanjing : Nanjing University , 2016 .

LILJESTRAND H , NYMAN T , GUNN L J , et al . PACStack: an authenticated call stack [EB ] . aiXiv Preprint arXiv: 1905.10242 , 2019 .

TICE C , ROEDER T , COLLINGBOURNE P , et al . Enforcing forward-edge control-flow integrity in GCC & LLVM [C ] // Proceedings of the 23rd USENIX Conference on Security Symposium . New York : ACM , 2014 : 941 - 955 .

NIU B , TAN G . Per-input control-flow integrity [C ] // Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2015 : 914 - 926 .

NIU B , TAN G . Modular control-flow integrity [C ] // Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation . New York : ACM , 2014 : 577 - 587 .

CRISWELL J , DAUTENHAHN N , ADVE V . KCoFI: complete control-flow integrity for commodity operating system kernels [C ] // Proceedings of the 2014 IEEE Symposium on Security and Privacy . Piscataway : IEEE Press , 2014 : 292 - 307 .

王明华 , 尹恒 , 苏璞睿 , 等 . 二进制代码块: 面向二进制程序的细粒度控制流完整性校验方法 [J ] . 信息安全学报 , 2016 , 1 ( 2 ): 61 - 72 .

WANG M H , YIN H , SU P R , et al . Binary code continent: finer-grained control flow integrity for stripped binaries [J ] . Journal of Cyber Security , 2016 , 1 ( 2 ): 61 - 72 .

ZHANG M W , SEKAR R . Control flow and code integrity for COTS binaries: an effective defense against real-world ROP attacks [C ] // Proceedings of the 31st Annual Computer Security Applications Conference . New York : ACM , 2015 : 91 - 100 .

HE W J , DAS S , ZHANG W , et al . BBB-CFI: lightweight CFI approach against code-reuse attacks using basic block information [J ] . ACM Transactions on Embedded Computing Systems , 2020 , 19 ( 1 ): 7 .

张正 , 薛静锋 , 张静慈 , 等 . 进程控制流完整性保护技术综述 [J ] . 软件学报 , 2023 , 34 ( 1 ): 489 - 508 .

ZHANG Z , XUE J F , ZHANG J C , et al . Survey on control-flow integrity techniques [J ] . Journal of Software , 2023 , 34 ( 1 ): 489 - 508 .

柳童 , 史岗 , 孟丹 . 代码重用攻击与防御机制综述 [J ] . 信息安全学报 , 2016 , 1 ( 2 ): 15 - 27 .

LIU T , SHI G , MENG D . A survey of code reuse attack and defense mechanisms [J ] . Journal of Cyber Security , 2016 , 1 ( 2 ): 15 - 27 .

HENNING J L . SPEC CPU2006 benchmark descriptions [J ] . ACM SIGARCH Computer Architecture News , 2006 , 34 ( 4 ): 1 - 17 .

CHEN G , JIN H , ZOU D Q , et al . SafeStack: automatically patching stack-based buffer overflow vulnerabilities [J ] . IEEE Transactions on Dependable and Secure Computing , 2013 , 10 ( 6 ): 368 - 379 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Software diversification method based on binary rewriting

Related Author

Benwei HE

Yunfei GUO

Yawen WANG

Qingfeng WANG

Hongchao HU

Related Institution

No data

⁰