Detail View

Ensuring that a program follows an uncompromised control flow at the machine instruction level can provide sound protection from control flow attacks that transfer a control flow to the attacker’s flow during program execution, such as code reuse attacks (CRAs). This thesis proposes incorporating the control-flow validation into the processor’s instruction execution pipeline. By introducing a mis-prediction validation unit (MVU) alongside the branch prediction unit (BPU), validating each control-flow transfer instance becomes an integral part of indirect branch instruction execution. MVU determines whether a mis-prediction from BPU is caused by a legitimate target address from a legitimate control-flow or a compromised target address from an attack. Since BPU is already validating a significant portion of the control-flow transfer instances via branch prediction, MVU introduces little performance overhead to the control-flow validation. Also, this thesis proposes an enhanced control data protection for control flow integrity, called Hard Wired Control Data Integrity (HW-CDI). HW-CDI hides the control data via encoding with a key and requires a proper decoding with the key for a correct control flow transfer. A unique aspect of HW-CDI is that this key changes in terms of not only the location but also the value of the control data. More specifically, this work describes how to incorporate the HW-CDI into the processor’s instruction pipeline so that it becomes an integral part of indirect branch instruction execution. It also provides information on how to generate the encoding/decoding keys without additional instrumented code. HW-CDI is able to differentiate control flow transfer instances, providing context-based protection at negligible performance overhead.

1. Introduction 1
2. Background 6
 2.1 Control Flow Integrity and Control Data Integrity 6
3. Mis-prediction Validation Unit 10
 3.1 Code Reuse Attacks and Branch Prediction 10
 3.2 Validating Branch Mis-Prediction 12
 3.3 IBP Buffer 16
4. Discussion and Limitation of MVU 18
5. Hard-Wired Control Data Integrity(HW-CDI) 20
 5.1 Basic Approach 20
 5.2 Encoding and Decoding 23
 5.3 Key for Encoding and Decoding 26
 5.4 Instruction Pipeline 31
 5.5 Effectiveness against Control Flow Attacks 33
6. Performance Overhead 39
 6.1 Mis-Prediction Validation Unit (MVU) 39
 6.2 Hard-Wired Control Data Integrity (HW-CDI) 43
7. Discussion: Comparison with Related Works 46
8. Conclusion 50
Bibliography 52