Share on Facebook Tweet on Twitter Share on LinkedIn Share by email
Architectural Support for Software-Based Protection

Mihai Budiu, Úlfar Erlingsson, and Martín Abadi

Abstract

Control-Flow Integrity (CFI) is a property that guarantees program control flow cannot be subverted by a malicious adversary, even if the adversary has complete control of data memory. We have shown in prior work how CFI can be enforced by using inlined software guards that perform safety checks. The first part of this paper shows how modest Instruction Set Architecture (ISA) support can replace such guard code with single instructions.

On the foundation of CFI we have implemented XFI: a protection system that offers fine-grained memory access control and fundamental integrity guarantees for critical system state. XFI can be seen as a flexible, generalized form of software-based fault isolation (SFI). In the second part of this paper we present ISA support for XFI, in the form of simple bounds-check instructions.

CFI and XFI can significantly increase the security and integrity of software execution. Our results indicate that support for CFI and XFI is a straightforward, simple addition t

Details

Publication typeInproceedings
Published inASID '06: Proceedings of the 1st workshop on Architectural and System Support for Improving Software Dependability
URLhttp://www.acm.org/
Pages42-51
NumberMSR-TR-2006-115
InstitutionMicrosoft Research
AddressSan Jose, CA
PublisherAssociation for Computing Machinery, Inc.
> Publications > Architectural Support for Software-Based Protection