HCIC: Hardware-Assisted Control-Flow Integrity Checking

Abstract

Recently, code reuse attacks (CRAs), such as returnoriented programming (ROP) and jump-oriented programming (JOP), have emerged as a new class of ingenious security threats. Attackers can utilize CRAs to hijack the control flow of programs to perform malicious actions without injecting any codes. Many defenses, classed into software-based and hardware-based, have been proposed. However, software-based methods are difficult to be deployed in practical systems due to high performance overhead. Hardware-based methods can reduce performance overhead but may require extending instruction set architectures (ISAs) and modifying the compiler or suffer the vulnerability of key leakage. To tackle these issues, this paper proposes a new hardware-assisted control flow checking method to resist CRAs with negligible performance overhead without extending ISAs, modifying the compiler or leaking the encryption/decryption key. The key technique involves two control flow checking mechanisms. The first one is the encrypted Hamming distances (EHDs) matching between the physical unclonable function (PUF) response and the return addresses, which prevents attackers from returning between gadgets so long as the PUF response is secret, thus resisting ROP attacks. The second one is the linear encryption/decryption operation (XOR) between the PUF response and the instructions at target addresses of call and jmp instructions to defeat JOP attacks. Advanced return-based full-function reuse attacks will be prevented with the dynamic key-updating method. Experimental evaluations on benchmarks demonstrate that the proposed method introduces negligible 0.95% runtime overhead and 0.78% binary size overhead on average.Index Terms-control flow integrity, code reuse attacks, physical unclonable function, hardware-assisted security.

A PUF-based and cloud-assisted lightweight authentication for multi-hop body area network

“…Even with the same design, different manufactured PUFs have different CRPs [23] . It is suitable for various security-related applications, such as two-factor authentication [24] , antioverbuilding [25] , IP protection [23,26] , and resisting of FPGA replay attacks [27] and code-reuse attacks [28] .…”

A CFI Countermeasure Against GOT Overwrite Attacks

“…However, researches are ongoing to improve the security and performance of CFI and make it practical. In particular, studies to achieve performance improvement of CFI through hardware support deserve attention [28]- [34]. For the comprehensive understanding on CFI, Burow et al [15] compare the precision, security, and performance of various CFI implementations.…”

“…However, library call intensive programs can be affected if time delays accumulate. In this situation, hardware aided protection schemes can be effective for better performance [32]- [34].…”

Physical Unclonable Function-Based Key Sharing via Machine Learning for IoT Security

“…Besides, a RO PUF does not require high symmetry and thereby is more easily to be implemented on FPGAs than other PUFs such as Arbiter PUF. In past decades, PUFs have attracted much attention in academia and industry for various security related applications such as hardware IP protection [3] [25], device authentication [8] [30] [34] and software security [31].…”