SHERLOC: Secure and Holistic Control-Flow Violation Detection on Embedded Systems
SHERLOC: Secure and Holistic Control-Flow Violation Detection on Embedded Systems
复制标题
DOI：
10.1145/3576915.3623077
复制
发表时间：
2023-11
期刊：
影响因子：
--
通讯作者：
Xi Tan;Ziming Zhao
中科院分区：
文献类型：
--
作者：
Xi Tan;Ziming Zhao
基于微处理器的嵌入式系统通常使用低级语言编程，容易受到控制流劫持攻击。防止此类攻击的一种方法是强制执行控制流完整性（CFI），但内联CFI强制执行可能会在嵌入式系统中带来挑战。例如，它会增加二进制大小并更改内存布局。基于跟踪的控制流违规检测（CFVD）提供了一种替代方案，不需要对受保护软件进行检测或更改其内存布局。然而，在桌面系统中使用的现有CFVD方法需要修改内核来存储和分析跟踪，这限制了它们用于监视非特权应用程序。但是，嵌入式系统是中断驱动的，大部分处理都是在特权模式下进行的。因此，提供一个整体的、面向系统的CFVD解决方案，可以监控特权和非特权组件内部和之间的控制流传输是至关重要的。在本文中，我们提出了SHERCITY，一个安全的和整体的控制流违规检测机制设计的微处理器为基础的嵌入式系统。SHERcycle通过配置硬件跟踪单元、存储跟踪记录以及在可信执行环境中执行违规检测算法来确保安全性，这防止特权程序绕过监视或篡改跟踪。我们解决的挑战，实现整体和面向系统的CFVD正式的问题和监测的前向和后向边缘的非特权和特权的程序，以及控制流之间的转移非特权和特权组件。具体来说，SHERRIGHT克服了在运行时识别合法的异步中断和上下文切换的挑战，通过使用中断和中断感知的违规检测算法。我们对ARMv 8-M架构的评估证明了SHERCITY的有效性和效率。
Microcontroller-based embedded systems are often programmed in low-level languages and are vulnerable to control-flow hijacking attacks. One approach to prevent such attacks is to enforce control-flow integrity (CFI), but inlined CFI enforcement can pose challenges in embedded systems. For example, it increases binary size and changes memory layout. Trace-based control-flow violation detection (CFVD) offers an alternative that doesn't require instrumentation of the protected software or changes to its memory layout. However, existing CFVD methods used in desktop systems require kernel modifications to store and analyze the trace, which limits their use to monitoring unprivileged applications. But, embedded systems are interrupt-driven, with the majority of processing taking place in the privileged mode. Therefore, it is critical to provide a holistic and system-oriented CFVD solution that can monitor control-flow transfers both within and among privileged and unprivileged components. In this paper, we present SHERLOC, a Secure and Holistic Control-Flow Violation Detection mechanism designed for microcontroller-based embedded systems. SHERLOC ensures security by configuring the hardware tracing unit, storing trace records, and executing the violation detection algorithm in a trusted execution environment, which prevents privileged programs from bypassing monitoring or tampering with the trace. We address the challenges of achieving holistic and system-oriented CFVD by formalizing the problem and monitoring forward and backward edges of unprivileged and privileged programs, as well as control-flow transfers among unprivileged and privileged components. Specifically, SHERLOC overcomes the challenges of identifying legitimate asynchronous interrupts and context switches at run-time by using an interrupt- and scheduling-aware violation detection algorithm. Our evaluations on the ARMv8-M architecture demonstrate the effectiveness and efficiency of SHERLOC.