Fine-grained Control-flow Integrity Research Articles

SCFI: Efficient forward fine-grained control flow integrity based on coarse-grained ISA extensions

Code reuse attack (CRA) is a severe threat to computer systems. To mitigate this threat, control-flow integrity (CFI) was proposed to restrict control-flow transfers. Processor vendors developed Instruction Set Architecture (ISA) extensions to enforce forward CFI on processors, such as Indirect Branch Tracking (IBT) developed by Intel and Branch Target Identification (BTI) developed by ARM. However, these extensions are coarse-grained and unable to provide enough security protection.We combine existing coarse-grained ISA extension with novel software modifications and propose a new fine-grained forward CFI implementation called Slot-based CFI (SCFI). SCFI consists of two software modifications: Slot Policy and ID Policy. Slot policy utilises lower bits of code address as labels to implement fine-grained CFI. ID Policy provides multi-label support to solve the destination equivalence problem. SCFI strengthens security by improving coarse-grained ISA extension to fine-grained CFI (improving Average Indirect Targets Allowed (AIA) from 752 to 6.24). SCFI costs negligible performance overhead (on average 0.78% in SPEC2006). It also has good performance in complex programs (1.12% in 471.omnetpp and 1.79% in 483.xalancbmk). In addition, SCFI only needs lightweight software instrument without hardware modification and supports complex control-flow graphs.

MAFIA: Protecting the Microarchitecture of Embedded Systems Against Fault Injection Attacks

Fault injection attacks represent an effective threat to embedded systems. Recently, Laurent et al. have reported that fault injection attacks can leverage faults inside the microarchitecture. However, state-of-the-art counter-measures, hardwareonly or with hardware support, do not consider the integrity of microarchitecture control signals that are the target of these faults. We present MAFIA, a microarchitecture protection against fault injection attacks. MAFIA ensures integrity of pipeline control signals through a signature-based mechanism, and ensures fine-grained control-flow integrity with a complete indirect branch support and code authenticity. We analyse the security properties of two different implementations with different security/ overhead trade-offs: one with a CBC-MAC/Prince signature function, and another one with a CRC32. We present our implementation of MAFIA in a RISC-V processor, supported by a dedicated compiler toolchain based on LLVM/Clang. We report a hardware area overhead of 23.8% and 6.5% for the CBC-MAC/Prince and CRC32 respectively. The average code size and execution time overheads are 29.4% and 18.4% respectively for the CRC32 implementation and are 50% and 39% for the CBC-MAC/Prince.

Speculation-Free Function Table Construction in LLVM IR for Fine-Grained Control Flow Integrity

Securing the operating system kernel is the key to overall system security. Due to developer negligence and the inherent limitations of the code language, kernel data is exposed to various security risks, such as execution flow leakage and privilege hijacking. In binary security, most vulnerabilities are exploited by hijacking the control flow to make the program run according to the attacker’s idea of attack. Control flow integrity is a common defense scheme against control flow hijacking attacks. In this paper, we use speculation-free function tables in LLVM IR to achieve the integrity of fine-grained control flow. The technique enforces CFI policies by making logical judgments on jump instruction stubbing. All jump instructions share a common function table, and the information in the table is not repeatedly stored, reducing the additional memory consumption caused by the function table and achieving fine-grained CFI protection.

BGCFI: Efficient Verification in Fine-Grained Control-Flow Integrity Based on Bipartite Graph

Control-flow integrity (CFI) is considered a principled mitigation against control-flow hijacking even under the most powerful attacker who can arbitrarily write and read memory. However, existing schemes still demonstrated limitations in either guaranteeing high security level or achieving low performance and memory overhead. These limitations have restricted the application of CFI in real software. To improve its applicability similar to mandatory protection schemes such as DEP and ASLR, it is essential to improve both high security guarantee and low overhead. In this paper, we propose “BGCFI”, which is a fine-grained CFI based on a Bipartite Graph. The relationship between an indirect branch and a valid target address at the branch is represented by an edge in the bipartite graph. The verification of the indirect branch is achieved by checking the existence of the corresponding edge in the bipartite graph. The verification method for fine-grained CFI results in more efficiency on both computational and memory overhead, while completely preserving high security guarantee. We demonstrate our results through the implementation of a proof-of-concept module and evaluation on the SPEC CPU 2017 suite and the Firefox browser.

FH-CFI: Fine-grained hardware-assisted control flow integrity for ARM-based IoT devices

Code reuse attacks (CRAs), such as return-oriented programming (ROP) and jump-oriented programming (JOP) attacks, have become a great threat to the runtime security of ARM-based Internet of Things (IoT) devices. Attackers can utilize CRAs to hijack the control flow of programs in ARM-based IoT devices to make them perform malicious actions without injecting any codes. Control flow integrity (CFI) is an important cornerstone for the security of ARM-based IoT devices, as it enforces the correct control flow of devices and defends against CRAs. However, coarse-grained CFI schemes suffer from security issues, like key leakage and coarse-grained protection, which allows attackers to bypass their defenses. Meanwhile, fine-grained CFI schemes bring high overhead and have the multi-to-one problem. In this paper, we propose FH-CFI, a fine-grained hardware-assisted CFI scheme to help ARM-based IoT devices resist refined CRAs without leaking their encryption/decryption keys. We utilize hash-based message authentication codes to protect the return addresses from being changed, thus resisting ROP attacks without key leakage. Moreover, we encrypt instructions at target sites with the call sites’ information to defeat JOP attacks in fine-grained. Additionally, we have designed a diverter to solve the multi-to-one problem that exists in fine-grained CFI schemes. Theoretical analyses demonstrate the security of our FH-CFI. Experimental evaluations on ARM-based IoT devices show that FH-CFI has greater effectiveness and stronger security than existing state-of-the-art CFI schemes, with few additional overheads.

NSGA-II-Based Granularity-Adaptive Control-Flow Attestation

Since the widespread adoption of edge computing and IoT technology, Control-Flow Hijacking (CFH) attacks targeting programs in resource-constrained embedded devices have become prevalent. While the Coarse-Grained Control-Flow integrity Attestation (CGCFA) lacks accuracy for the CFH attacks detection, the Fine-Grained Control-Flow integrity Attestation (FGCFA) detect the attacks more accurately but with high overheads, which can be a big burden (e.g., to industrial control system with strict performance requirements). In this paper, we propose a NSGA-II (Nondominated Sorting Genetic Algorithm-II) based Granularity-Adaptive Control-Flow Attestation (GACFA) for the programs in embedded devices. Specifically, we propose a Granularity-Adaptive Control-Flow representation model to reduce the complexity of programs’ control-flow graph and propose NSGA-II-based granularity-adaptive strategy generation algorithm to balance the security and performance requirements. Besides, runtime protection for the GACFA at the program end with SGX is proposed to protect the integrity and confidentiality of control-flow measurement data. The experiments show that our work can find out the best-so-far control-flow granularity with stability and provide secure program attestation for the verifier. In addition, the security/performance benefit of adopting our proposal over CGCFA is 13.7, 25.1, and 43.0 times that of adopting FGCFA over ours in different threat scenarios.

FastCFI: Real-time Control-Flow Integrity Using FPGA without Code Instrumentation

Control-Flow Integrity (CFI) is an effective defense technique against a variety of memory-based cyber attacks. CFI is usually enforced through software methods, which entail considerable performance overhead. Hardware-based CFI techniques can largely avoid performance overhead, but typically rely on code instrumentation, forming a non-trivial hurdle to the application of CFI. Taking advantage of the tradeoff between computing efficiency and flexibility of FPGA, we develop FastCFI, an FPGA-based CFI system that can perform fine-grained and stateful checking without code instrumentation. We also propose an automated Verilog generation technique that facilitates fast deployment of FastCFI, and a compression algorithm for reducing the hardware expense. Experiments on popular benchmarks confirm that FastCFI can detect fine-grained CFI violations over unmodified binaries. When using FastCFI on prevalent benchmarks, we demonstrate its capability to detect fine-grained CFI violations in unmodified binaries, while incurring an average of 0.36% overhead and a maximum of 2.93% overhead.

Random CFI (RCFI): Efficient Fine-Grained Control-Flow Integrity Through Random Verification

In theory, Control-Flow Integrity (CFI) is considered a principled solution against control-data attacks. However, most fine-grained CFI schemes that ensure such high security suffer from significant performance overhead. Existing practical implementations have been proposed to overcome this performance overhead problem, but they have proven unable to guarantee high security because development of these implementations has focused on only improving performance, at the expense of the security guarantee. Even though it is important for CFI schemes to provide both high security and low performance overhead, existing research on CFI is limited either by way of performance or security guarantee. We propose a new approach of verification method in fine-grained CFI to achieve these two goals. Our scheme performs selective and random verifications for certain branches rather than all branches, and thus, can reduce performance overhead. We show improved performance by evaluating our proof-of-concept implementation on SPEC CPU 2017. In addition, we also show that our scheme does not significantly sacrifice the security guarantee of fine-grained CFI by analyzing the structure of existing control-data attack exploits, which were collected from real-world exploits DB and related literature.

ABCFI: Fast and Lightweight Fine-Grained Hardware-Assisted Control-Flow Integrity

Code-reuse attack is a severe threat to computer systems as it can circumvent many existing security defenses and perform arbitrary behavior. Control-flow integrity (CFI) is a security technique that restricts control-flow transfers to prevent the attack. Although CFI has been implemented via various methods, including hardware-assisted extensions, the current designs of hardware-assisted fine-grained CFI fail to meet practical needs. The main hurdles include: 1) the lack of cost-effective design and 2) insufficient security as they cannot enforce a complete control-flow graph (CFG) with only one label for each target. This article presents a novel hardware-assisted fine-grained CFI design that reformulates labels as the lower bits of addresses (called address-based CFI). Thus, it costs negligible runtime overhead (≤ 0.55%) and hardware overhead (only ten LUTs and no flip flop based on coarse-grained extension). Among all the current hardware-assisted fine-grained CFI designs, ABCFI has the lowest hardware overhead and runtime performance overhead. With our novel design, the commercial coarse-grained CFI extensions can be advanced to fine-grained CFI extensions through few efforts.

TrustFlow-X

This article addresses the challenges of memory safety in life-critical medical devices. Since the last decade, healthcare manufacturers have embraced the Internet of Things, pushing technological innovations to increase market share. Medical devices, including the most critical ones, tend to be increasingly connected to the Internet. Unfortunately, as critical devices often rely on unsafe programming languages such as C, they are no exception to memory safety issues. Given a memory vulnerability, a skillful attacker can take over a system and perform remote code execution. Combined with the fact that medical devices directly impact the safety of their users, a security vulnerability can lead to disastrous scenarios. To address this issue, this article presents TrustFlow-X, a novel hardware/software co-designed framework that provides efficient fine-grained control-flow integrity protection against memory-based attacks. The TrustFlow-X framework is composed of an LLVM-based compiler toolchain that generates a secure code. This secure code is then executed on an extended RISC-V processor that keeps track of sensitive data using a trusted memory. The obtained results show that the contribution is practical, providing a high level of trust in life-critical embedded systems.

IBV-CFI: Efficient fine-grained control-flow integrity preserving CFG precision

Control-flow integrity (CFI) is a software security solution that prevents software attacks such as control-flow hijacking by restricting the indirect control-flow transfers (ICT) to a pre-computed control-flow graph (CFG). Since the validity of ICTs are determined based on CFG on the CFI mechanism, CFG precision is an important factor in determining CFI security level. However, checking the validity of ICTs based on a precise CFG can incur significant runtime overhead. For this reason, many existing CFI schemes have used a runtime check mechanism that compromises the precision of the CFG.In this paper, we present an Index-based Bit Vector Control-Flow Integrity scheme (IBV-CFI), which performs an efficient runtime check while preserving CFG precision. IBV-CFI generates independent bit vectors for all ICTs and stores a valid target set for each ICT in the bit vector. Independent bit vectors accurately reflect the CFG, so they do not compromise the precision of CFG. In addition, it is possible to determine the validity of the target of the indirect branch through a simple bit value comparison, which enables an efficient runtime check. We implemented a prototype model, IBV-CFI, and performed performance measurements using the SPEC CPU 2017 benchmarks and three real-world applications. The results show that IBV-CFI introduces approximately 1.42% performance overhead.

Hardware Assisted Buffer Protection Mechanisms for Embedded RISC-V

RISC-V is a promising open-source architecture that targets low-power embedded devices and system-on-chips (SoCs). However, there is a dearth of practical and low-overhead security solutions in the RISC-V architecture. Programs compiled using RISC-V toolchains are still vulnerable to code injection and code reuse attacks, such as buffer overflow and return-oriented programming (ROP). In this article, we propose two hardware-implemented security extensions to RISC-V that provides a defense mechanism against such attacks. We first employ a physically unclonable function (PUF)-based randomized canary generation technique that removes the need to store the sensitive canary words in memory or CPU registers, thereby being more secure, while incurring low overheads. We implement the proposed Canary Engine in RISC-V RocketChip with rocket custom coprocessor (RoCC). The simulation results show 2.2% average execution overhead with a single buffer protection, while a 10× increase in buffer count only increases the overhead by 1.5× when protection is extended to all buffers. We further improve upon this with a dedicated security coprocessor flow integrity extensions for embedded RISC-V (FIXER), implemented on the RoCC. FIXER enforces fine-grained control-flow integrity (CFI) of running programs on backward edges (returns) and forward edges (calls) without requiring any architectural modifications to the processor core. Compared to software-based solutions, FIXER reduces energy overhead by 60% at minimal execution time (1.5%) and area (2.9%) overheads.

Corrigendum to “Fine-Grained Control-Flow Integrity Based on Points-to Analysis for CPS”

Corrigendum to “Fine-Grained Control-Flow Integrity Based on Points-to Analysis for CPS”

Fine-Grained Control-Flow Integrity Based on Points-to Analysis for CPS

A cyber-physical system (CPS) is known as a mix system composed of computational and physical capabilities. The fast development of CPS brings new security and privacy requirements. Code reuse attacks that affect the correct behavior of software by exploiting memory corruption vulnerabilities and reusing existing code may also be threats to CPS. Various defense techniques are proposed in recent years as countermeasures to emerging code reuse attacks. However, they may fail to fulfill the security requirement well because they cannot protect the indirect function calls properly when it comes to dynamic code reuse attacks aiming at forward edges of control-flow graph (CFG). In this paper, we propose P-CFI, a fine-grained control-flow integrity (CFI) method, to protect CPS against memory-related attacks. We use points-to analysis to construct the legitimate target set for every indirect call cite and check whether the target of the indirect call cite is in the legitimate target set at runtime. We implement a prototype of P-CFI on LLVM and evaluate both its functionality and performance. Security analysis proves that P-CFI can mitigate the dynamic code reuse attack based on forward edges of CFG. Performance evaluation shows that P-CFI can protect CPS from dynamic code reuse attacks with trivial time overhead between 0.1% and 3.5% (Copyright © 2018 John Wiley & Sons, Ltd.).

A Technique Preventing Code Reuse Attacks Based on RISC Processor

A full-process tag inspection system was designed and experimentally verified. This system based on RISC processors can defend code reuse attacks, as well as prevent high overhead caused by the implementation of software fine-grained control flow integrity technology. By extending memory tag, adding special memory-access instructions and setting up security rules, this design achieves hardware-based fine-grained control flow integrity, which can defend against attacks of ROP, JOP and COOP. The experimental measurement have been performed to validate that this design has effective effect on defending CRA with low overhead, which is evaluated on the RISC-V platform.

Fine-CFI: Fine-Grained Control-Flow Integrity for Operating System Kernels

The operating system kernel is often the security foundation for the whole system. To prevent attacks, control-flow integrity (CFI) has been proposed to ensure that any control transfer during the program’s execution never deviates from its control-flow graph (CFG). Existing CFI solutions either work in user space or are coarse-grained; thus they cannot be readily deployed in kernels or are vulnerable to state-of-the-art attacks. In this paper, we present Fine-CFI, a system that enforces fine-grained CFI for operating system kernels. Unlike previous systems, Fine-CFI constructs the kernel’s fine-grained CFG with a retrofitted context-sensitive and field-sensitive pointer analysis, then enforces CFI with this CFG. At the same time, Fine-CFI provides comprehensive protection to the control data in the kernel’s interrupt context. Combining the above two kinds of protection, we can thus defeat those formidable ret2usr and kernel code-reuse attacks. We have developed a compiler-based prototype and implemented this technique in Linux 3.14 kernel. Our evaluation indicates that Fine-CFI prevents all the gadgets found by an open-source gadget-finding tool from being misused, as well as all the attacks from the RIPE benchmark and malicious attempts to modify control data in the interrupt context; and it also reduces the number of indirect control-flow targets by 99.998%, thus largely raising the bar for attackers. Our evaluation also shows that the performance overhead introduced by Fine-CFI is less than 10% on average.

GRIFFIN

Researchers are actively exploring techniques to enforce control-flow integrity (CFI), which restricts program execution to a predefined set of targets for each indirect control transfer to prevent code-reuse attacks. While hardware-assisted CFI enforcement may have the potential for advantages in performance and flexibility over software instrumentation, current hardware-assisted defenses are either incomplete (i.e., do not enforce all control transfers) or less efficient in comparison. We find that the recent introduction of hardware features to log complete control-flow traces, such as Intel Processor Trace (PT), provides an opportunity to explore how efficient and flexible a hardware-assisted CFI enforcement system may become. While Intel PT was designed to aid in offline debugging and failure diagnosis, we explore its effectiveness for online CFI enforcement over unmodified binaries by designing a parallelized method for enforcing various types of CFI policies. We have implemented a prototype called GRIFFIN in the Linux 4.2 kernel that enables complete CFI enforcement over a variety of software, including the Firefox browser and its jitted code. Our experiments show that GRIFFIN can enforce fine-grained CFI policies with shadow stack as recommended by researchers at a performance that is comparable to software-only instrumentation techniques. In addition, we find that alternative logging approaches yield significant performance improvements for trace processing, identifying opportunities for further hardware assistance.

GRIFFIN

Researchers are actively exploring techniques to enforce control-flow integrity (CFI), which restricts program execution to a predefined set of targets for each indirect control transfer to prevent code-reuse attacks. While hardware-assisted CFI enforcement may have the potential for advantages in performance and flexibility over software instrumentation, current hardware-assisted defenses are either incomplete (i.e., do not enforce all control transfers) or less efficient in comparison. We find that the recent introduction of hardware features to log complete control-flow traces, such as Intel Processor Trace (PT), provides an opportunity to explore how efficient and flexible a hardware-assisted CFI enforcement system may become. While Intel PT was designed to aid in offline debugging and failure diagnosis, we explore its effectiveness for online CFI enforcement over unmodified binaries by designing a parallelized method for enforcing various types of CFI policies. We have implemented a prototype called GRIFFIN in the Linux 4.2 kernel that enables complete CFI enforcement over a variety of software, including the Firefox browser and its jitted code. Our experiments show that GRIFFIN can enforce fine-grained CFI policies with shadow stack as recommended by researchers at a performance that is comparable to software-only instrumentation techniques. In addition, we find that alternative logging approaches yield significant performance improvements for trace processing, identifying opportunities for further hardware assistance.

A Fine-Grained Control Flow Integrity Approach Against Runtime Memory Attacks for Embedded Systems

Runtime attacks on memory, such as buffer overflow based stack smashing and code reuse attacks, are common in embedded systems. Control flow integrity (CFI) has been acknowledged as one promising approach to protect against such runtime attacks. However, previous CFI implementations suffer from coarse granularity (which can be circumvented by an advanced attack model) and high-performance overhead. In this paper, first, we present an approach to enforce fine-grained CFI at a basic block level, named basic block CFI (BB-CFI), which aims to defend against aforesaid attacks. The key idea is to verify the target address (TA) of control flow instructions (CFINs) (e.g., $\mathtt{call}$ , $\mathtt{ret}$ , and $\mathtt{jmp}$ ), which may be modified by the adversary. BB-CFI contains two stages: 1) offline profiling of the program—to extract the control flow information and 2) runtime control flow checking—to verify the TA of CFINs using the extracted information. We also handle the exceptional cases (e.g., multithreading, C++ exception, and longjump) that are found in complex binaries. Second, we propose an architectural design of control flow checker (CFC), which monitors the program execution during runtime to enforce BB-CFI. For proof of concept, we implement the CFC in field-programmable gate array (FPGA). Our method does not require the modification of the source code or the instruction set architecture. The experimental results demonstrate that BB-CFI is effective against runtime attacks, with 100% verification accuracy. The CFC implementation on FPGA shows <1% performance overhead and a small dynamic power consumption of 78 mW, with very small area footprint.

Modular control-flow integrity

Control-Flow Integrity (CFI) is a software-hardening technique. It inlines checks into a program so that its execution always follows a predetermined Control-Flow Graph (CFG). As a result, CFI is effective at preventing control-flow hijacking attacks. However, past fine-grained CFI implementations do not support separate compilation, which hinders its adoption. We present Modular Control-Flow Integrity (MCFI), a new CFI technique that supports separate compilation. MCFI allows modules to be independently instrumented and linked statically or dynamically. The combined module enforces a CFG that is a combination of the individual modules' CFGs. One challenge in supporting dynamic linking in multithreaded code is how to ensure a safe transition from the old CFG to the new CFG when libraries are dynamically linked. The key technique we use is to have the CFG represented in a runtime data structure and have reads and updates of the data structure wrapped in transactions to ensure thread safety. Our evaluation on SPECCPU2006 benchmarks shows that MCFI supports separate compilation, incurs low overhead of around 5%, and enhances security.