Hardware support for code integrity in embedded processors

ABSTRACT

Computer security becomes increasingly important with continual growth of the number of interconnected computing platforms. Moreover, as capabilities of embedded processors increase, the applications running on these systems also grow in size and complexity, and so does the number of security vulnerabilities. Attacks that impair code integrity by injecting and executing malicious code are one of the major security issues. This problem can be addressed at different levels, from more secure software and operating systems, down to solutions that require hardware support. Most of the existing techniques tackle the problem of security flaws at the software level, but this approach lacks generality and often induces prohibitive overhead in performance and cost, or generates a significant number of false alarms. On the other hand, a further increase in the number of transistors on a single chip enables integrated hardware support for functions that formerly were restricted to the software domain. Hardware-supported defense techniques have the potential to be more general and more efficient than solely software solutions. This paper proposes four new architectural extensions to ensure complete run-time code integrity using instruction block signature verification. The experimental analysis shows that the proposed techniques have low performance and energy overhead. In addition, the proposed mechanism has low hardware complexity, and does not impose either changes to the compiler or changes to the existing instruction set architecture.

REFERENCES

• 1: "Enhanced Aes (Rijndael) IP Core," http://www.asics.ws (Available December 2004).
• 2: "Intel Xscale® Core Developer's Manual," http://www.intel.com/design/intelxscale/ (Available December 2004).
• 3: Dave Ahmad, The Rising Threat of Vulnerabilities Due to Integer Errors, IEEE Security and Privacy, v.1 n.4, p.77-82, July 2003 [doi>10.1109/MSECP.2003.1219077]
• 4: Todd Austin , Eric Larson , Dan Ernst, SimpleScalar: An Infrastructure for Computer System Modeling, Computer, v.35 n.2, p.59-67, February 2002 [doi>10.1109/2.982917]
• 5: Bhatkar, S., DuVarney, D. C., and Sekar, R., "Address Obfuscation: An Approach to Combat Buffer Overflows, Format-String Attacks, and More," in Proceedings of the 12th USENIX Security Symposium, Washington, DC, USA, 2003, 105--120.
• 6: I. Branovic , R. Giorgi , E. Martinelli, A workload characterization of elliptic curve cryptography methods in embedded environments, ACM SIGARCH Computer Architecture News, v.32 n.3, p.27-34, June 2004
• 7: Busser, P., "Memory Protection with Pax and the Stack Smashing Protector: Breaking out Peace," Linux Magazine, 40(March 2004), 36--39.
• 8: Conover, M., "w00w00 on Heap Overflows," http://www.w00w00.org/files/articles/heaptut.txt (Available January 2005).
• 9: Corliss, M., Lewis, E. C., and Roth, A., "Using DISE to Protect Return Addresses from Attack," in Proceedings of the Workshop on Architectural Support for Security and Anti-Virus (WASSA), Boston, MA, USA, 2004, 61--68.
• 10: Cowan, C., Beattie, S., Johansen, J., and Wagle, P., "Pointguard™: Protecting Pointers from Buffer Overflow Vulnerabilities," in Proceedings of the 12th USENIX Security Symposium, Washington, DC, USA, 2003, 91--104.
• 11: Cowan, C., Pu, C., Maier, D., Walpole, J., Bakke, P., Beattie, S., Grier, A., Wagle, P., Zhang, Q., and Hinton, H., "Stackguard: Automatic Adaptive Detection and Prevention of Buffer Overflow Attacks," in Proceedings of the 7th USENIX Security Conference, San Antonio, TX, USA, 1998, 63--78.
• 12: Jedidiah R. Crandall , Frederic T. Chong, Minos: Control Data Attack Prevention Orthogonal to Memory Model, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.221-232, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.26]
• 13: Dobrovitski, I., "Exploit for Cvs Double free() for Linux pserver," http://seclists.org/lists/bugtraq/2003/Feb/0042.html (Available January 2005).
• 14: Nurit Dor , Michael Rodeh , Mooly Sagiv, CSSV: towards a realistic tool for statically detecting all buffer overflows in C, Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation, June 09-11, 2003, San Diego, California, USA
• 15: Milenko Drinic , Darko Kirovski, A Hardware-Software Platform for Intrusion Prevention, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.233-242, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.2]
• 16: Fetzer, C. and Xiao, Z., "Detecting Heap Smashing Attacks through Fault Containment Wrappers," in Proceedings of the 20th IEEE Symposium on Reliable Distributed Systems, New Orleans, LA, USA, 2001, 80--89.
• 17: Guthaus, M. R., Ringenberg, J. S., Ernst, D., Austin, T. M., Mudge, T., and Brown, R. B., "MiBench: A Free, Commercially Representative Embedded Benchmark Suite," in Proceedings of the IEEE 4th Annual Workshop on Workload Characterization, Austin, TX, USA, 2001.
• 18: Gaurav S. Kc , Angelos D. Keromytis , Vassilis Prevelakis, Countering code-injection attacks with instruction-set randomization, Proceedings of the 10th ACM conference on Computer and communications security, October 27-30, 2003, Washington D.C., USA [doi>10.1145/948109.948146]
• 19: Nam Sung Kim , Taeho Kgil , Valeria Bertacco , Todd Austin , Trevor Mudge, Microarchitectural power modeling techniques for deep sub-micron microprocessors, Proceedings of the 2004 international symposium on Low power electronics and design, August 09-11, 2004, Newport Beach, California, USA [doi>10.1145/1013235.1013290]
• 20: Darko Kirovski , Milenko Drinić , Miodrag Potkonjak, Enabling trusted software integrity, Proceedings of the 10th international conference on Architectural support for programming languages and operating systems, October 05-09, 2002, San Jose, California
• 21: Larus, J. R., Ball, T., Das, M., DeLine, R., Fähndrich, M., Pincus, J., Rajamani, S. K., and Venkatapathy, R., "Righting Software," IEEE Software, 21, 3 (May-June 2004), 92--100.
• 22: Lee, C., Potkonjak, M., and Mangione-Smith, W. H., "MediaBench: A Tool for Evaluating and Synthesizing Multimedia and Communications Systems," IEEE Micro, 30, 1 (December 1997), 330--335.
• 23: Lee, R. B., Karig, D. K., McGregor, J. P., and Shi, Z., "Enlisting Hardware Architecture to Thwart Malicious Code Injection," in Proceedings of the Security in Pervasive Computing, Boppard, Germany, 2003, 237--252.
• 24: Kyung-suk Lhee , Steve J. Chapin, Type-Assisted Dynamic Buffer Overflow Detection, Proceedings of the 11th USENIX Security Symposium, p.81-88, August 05-09, 2002
• 25: David Lie Chandramohan Thekkath , Mark Mitchell , Patrick Lincoln , Dan Boneh , John Mitchell , Mark Horowitz, Architectural support for copy and tamper resistant software, Proceedings of the ninth international conference on Architectural support for programming languages and operating systems, p.168-177, November 2000, Cambridge, Massachusetts, United States
• 26: A. Mahmood , E. J. McCluskey, Concurrent Error Detection Using Watchdog Processors-A Survey, IEEE Transactions on Computers, v.37 n.2, p.160-174, February 1988 [doi>10.1109/12.2145]
• 27: Milena Milenkovic , Emil Jovanov, Architectures for run-time verification of code integrity, University of Alabama in Huntsville, Huntsville, AL, 2005
• 28: Milena Milenković , Aleksandar Milenković , Emil Jovanov, A framework for trusted instruction execution via basic block signature verification, Proceedings of the 42nd annual Southeast regional conference, April 02-03, 2004, Huntsville, Alabama [doi>10.1145/986537.986582]
• 29: Milenkovic, M., Milenkovic, A., and Jovanov, E., "Using Instruction Block Signatures to Counter Code Injection Attacks," in Proceedings of the Workshop on Architectural Support for Security and Anti-Virus (WASSA), Boston, MA, USA, 2004, 104--113.
• 30: Newsham, T., "Format String Attacks," September 2000, http://www.securityfocus.com/guest/3342 (Available January 2004).
• 31: One, A., "Smashing the Stack for Fun and Profit," Phrack Magazine, 7, 49 (November 1996).
• 32: Oppenheimer, D. L. and Martonosi, M. R., "Performance Signatures: A Mechanism for Intrusion Detection," in Proceedings of the 1997 IEEE Information Survivability Workshop, San Diego, CA, USA, 1997.
• 33: Ozdoganoglu, H., Brodley, C. E., Vijaykumar, T. N., Kuperman, B. A., and Jalote, A., "SmashGuard: A Hardware Solution to Prevent Security Attacks on the Function Return Address," Purdue University, TR-ECE 03--13, November 22, 2003.
• 34: R. Sekar , M. Bendre , D. Dhurjati , P. Bollineni, A Fast Automaton-Based Method for Detecting Anomalous Program Behaviors, Proceedings of the 2001 IEEE Symposium on Security and Privacy, p.144, May 14-16, 2001
• 35: Zili Shao , Qingfeng Zhuge , Yi He , Edwin H. -M. Sha, Defending Embedded Systems Against Buffer Overflow via Hardware/Software, Proceedings of the 19th Annual Computer Security Applications Conference, p.352, December 08-12, 2003
• 36: Shen, J. P. and Schuette, M. A., "On-Line Self-Monitoring Using Signatured Instruction Streams," in Proceedings of the 1983 IEEE International Test Conference, Philadelphia, PA, USA, 1983, 275--282.
• 37: G. Edward Suh , Jae W. Lee , David Zhang , Srinivas Devadas, Secure program execution via dynamic information flow tracking, Proceedings of the 11th international conference on Architectural support for programming languages and operating systems, October 07-13, 2004, Boston, MA, USA
• 38: Nathan Tuck , Brad Calder , George Varghese, Hardware and Binary Modification Support for Code Pointer Protection From Buffer Overflow, Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture, p.209-220, December 04-08, 2004, Portland, Oregon [doi>10.1109/MICRO.2004.20]
• 39: US-CERT, "Cert/Cc Statistics," http://www.cert.org/stats/ (Available December 2003).
• 40: US-CERT, "Cyber Security Bulletin Sb04--231," http://www.us-cert.gov/cas/bulletins/SB04--231.html (Available November 2004).
• 41: Wagner, D., Foster, J. S., Brewer, E. A., and Aiken, A., "A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities," in Proceedings of the Network and Distributed System Security Symposium (NDCS), San Diego, CA, USA, 2000.
• 42: Wilken, K. and Shen, J. P., "Continuous Signature Monitoring: Low-Cost Concurrent Detection of Processor Control Errors," IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, 9, 6 (June 1990), 629--641.
• 43: Xu, J., Kalbarczyk, Z., Patel, S., and Iyer, R. K., "Architecture Support for Defending against Buffer Overflow Attacks," in Proceedings of the Workshop on Evaluating and Architecting System dependability (EASY), San Jose, CA, USA, 2002.
• 44: Jun Yang , Youtao Zhang , Lan Gao, Fast Secure Processor for Inhibiting Software Piracy and Tampering, Proceedings of the 36th annual IEEE/ACM International Symposium on Microarchitecture, p.351, December 03-05, 2003
• 45: Ye, D. and Kaeli, D., "A Reliable Return Address Stack: Microarchitectural Features to Defeat Stack Smashing," in Proceedings of the Workshop on Architectural Support for Security and Anti-Virus (WASSA), Boston, MA, USA, 2004, 69--76.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.1 PROCESSOR ARCHITECTURES

Additional Classification:
  C. Computer Systems Organization
  C.3 SPECIAL-PURPOSE AND APPLICATION-BASED SYSTEMS
      Subjects: Real-time and embedded systems

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

General Terms:
Design, Performance, Security

Keywords:
attacks, code injection, code integrity