Search papers, labs, and topics across Lattice.
This paper introduces ROLoad-PMP, a lightweight hardware-software co-design solution aimed at securing sensitive operations in low-level software, such as kernels and bare-metal firmware, from hijacking attacks. By implementing new instructions that load data only from read-only memory regions with specific keys and a program hardening mechanism that classifies operands at compile-time, ROLoad-PMP achieves robust forward-edge control-flow integrity with minimal performance overhead. The FPGA-based prototype demonstrates that ROLoad-PMP incurs less than 1.40% additional hardware resource cost and enables lightweight defenses with negligible overheads under 0.853%.
ROLoad-PMP achieves robust security for low-level software with less than 1.40% hardware overhead while enabling lightweight defenses that outperform existing solutions.
A common way for attackers to compromise victim systems is hijacking sensitive operations (e.g., control-flow transfers) with attacker-controlled inputs. Existing solutions in general only protect parts of these targets and have high performance overheads, which are impractical and hard to deploy on systems with limited resources (e.g., IoT devices) or for low-level software like kernels and bare-metal firmware. In this paper, we present a lightweight hardware-software co-design solution ROLoad-PMP to protect sensitive operations from being hijacked for low-level software. First, we propose new instructions, which only load data from read-only memory regions with specific keys, to guarantee the integrity of pointees pointed by (potentially corrupted) data pointers. Then, we provide a program hardening mechanism to protect sensitive operations, by classifying and placing their operands into read-only memory with different keys at compile-time and loading them with ROLoad-PMP-family instructions at runtime. We have implemented an FPGA-based prototype of ROLoad-PMP based on RISC-V, and demonstrated an important defense application, i.e., forward-edge control-flow integrity. Results showed that ROLoad-PMP only costs few extra hardware resources (<inline-formula><tex-math notation="LaTeX">$\lt 1.40\%$</tex-math><alternatives><mml:math display="inline"><mml:mo><</mml:mo><mml:mn>1.40</mml:mn><mml:mi mathvariant="normal">%</mml:mi></mml:math><inline-graphic xlink:href="tan-ieq1-3449105.gif"/></alternatives></inline-formula>). Moreover, it enables many lightweight (e.g., with negligible overheads <inline-formula><tex-math notation="LaTeX">$\lt 0.853\%$</tex-math><alternatives><mml:math display="inline"><mml:mo><</mml:mo><mml:mn>0.853</mml:mn><mml:mi mathvariant="normal">%</mml:mi></mml:math><inline-graphic xlink:href="tan-ieq2-3449105.gif"/></alternatives></inline-formula>) defenses, and provides broader and stronger security guarantees than existing hardware solutions, e.g., ARM BTI and Intel CET.
Tsinghua AI