Abstract
Control-flow integrity (CFI) is a software security solution that prevents software attacks such as control-flow hijacking by restricting the indirect control-flow transfers (ICT) to a pre-computed control-flow graph (CFG). Since the validity of ICTs are determined based on CFG on the CFI mechanism, CFG precision is an important factor in determining CFI security level. However, checking the validity of ICTs based on a precise CFG can incur significant runtime overhead. For this reason, many existing CFI schemes have used a runtime check mechanism that compromises the precision of the CFG.In this paper, we present an Index-based Bit Vector Control-Flow Integrity scheme (IBV-CFI), which performs an efficient runtime check while preserving CFG precision. IBV-CFI generates independent bit vectors for all ICTs and stores a valid target set for each ICT in the bit vector. Independent bit vectors accurately reflect the CFG, so they do not compromise the precision of CFG. In addition, it is possible to determine the validity of the target of the indirect branch through a simple bit value comparison, which enables an efficient runtime check. We implemented a prototype model, IBV-CFI, and performed performance measurements using the SPEC CPU 2017 benchmarks and three real-world applications. The results show that IBV-CFI introduces approximately 1.42% performance overhead.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.