Run-time control flow authentication: an assessment on contemporary x86 platforms

  • Authors:

  • Erdem Aktas;Kanad Ghose

  • Affiliations:

  • State University of New York at Binghamton, New York;State University of New York at Binghamton, New York

  • Venue:
  • Proceedings of the 28th Annual ACM Symposium on Applied Computing
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

We propose and experimentally evaluate a technique of authenticating the execution of a program through the continuous run-time validation of control flow. Control flow authentication is useful in detecting security violations that alter the normal flow of control at run time through techniques such as call stack smashing, return and jump-oriented programming. Our technique relies on the use of existing support for branch tracing in contemporary processors, typified by the branch trace store (BTS) mechanism of contemporary Intel x86 server Platforms. In contrast to existing techniques that require code modification, either statically or at run-time, our technique requires no modifications to the binaries, thus preserving binary compatibility. In this paper, we demonstrate how the existing hardware support for branch tracing can be used to perform control flow validation covering each and every executed control flow instruction in an application or the kernel as they run. Although the performance overhead for full and continuous control flow authentication for an entire application is significant, we show how the technique can be used judiciously to selectively perform full and continuous control flow validation of critical functions with a tolerable overhead. As an example of this selective approach, we show how our technique detects security compromises introduced by kernel rootkits with a tolerable overhead.