Strato: A Retargetable Framework for Low-Level Inlined-Reference Monitors
نویسندگان
چکیده
Low-level Inlined Reference Monitors (IRM) such as control-flow integrity and software-based fault isolation can foil numerous software attacks. Conventionally, those IRMs are implemented through binary rewriting or transformation on equivalent low-level programs that are tightly coupled with a specific Instruction Set Architecture (ISA). Resulting implementations have poor retargetability to different ISAs. This paper introduces an IRM-implementation framework at a compiler intermediate-representation (IR) level. The IR-level framework enables easy retargetability to different ISAs, but raises the challenge of how to preserve security at the low level, as the compiler backend might invalidate the assumptions at the IR level. We propose a constraint language to encode the assumptions and check whether they still hold after the backend transformations and optimizations. Furthermore, an independent verifier is implemented to validate the security of low-level code. We have implemented the framework inside LLVM to enforce the policy of control-flow integrity and data sandboxing for both reads and writes. Experimental results demonstrate that it incurs modest runtime overhead of 19.90% and 25.34% on SPECint2000 programs for x8632 and x86-64, respectively.
منابع مشابه
Secure Optimization of Inlined Reference Monitors
Inlined Reference Monitor (IRM) is the preferred enforcement mechanism for historybased access control policies. IRM enforcement injects monitoring code into the binary of an untrusted program in order to track its execution history. The injected code denies access when execution deviates from the policy. The viability of IRM enforcement is predicated on the ability of the binary rewriting elem...
متن کاملAspect-Oriented Runtime Monitor Certification
In-lining runtime monitors into untrusted binary programs via aspect-weaving is an increasingly popular technique for efficiently and flexibly securing untrusted mobile code. However, the complexity of the monitor implementation and in-lining process in these frameworks can lead to vulnerabilities and low assurance for code-consumers. This paper presents a machine-verification technique for asp...
متن کاملVerified and Optimized Inlined Reference Monitors
Current software stacks are built on top of unsafe languages such as C and C++. Software attacks sabotage program executions by inducing control flow transfers to shellcode or manipulating data pointers to read/write sensitive information. By embedding security checks into subject programs during compilation, many attacks can be foiled effectively. In this proposal, we investigate current softw...
متن کاملA Proof Carrying Code Framework for Inlined Reference Monitors in Java Bytecode
We propose a lightweight approach for certification of Java bytecode monitor inlining using proof-carrying code. The main purpose of such a framework is to enable development use of monitoring for quality assurance, while minimizing the runtime overhead of monitoring, minimizing the need for changes to the loadand runtime tcb, and eliminating the need for post-shipping code rewrites with the re...
متن کاملAnalytical Performance and Quality Control of a Glucose Monitor System
Background and Objective: The reliability and validity of monitors for self-monitoring of blood glucose are debated. We evaluated the analytical performance of Accu-check Active (Boehringer Mannheim, Roche) which is one of the most commonly used monitors in Iran. Material and Methods: We compared the monitor readings with the reference values by percentage of values within...
متن کامل