Architectural Support for Run-Time Validation of Control Flow Transfer

—Current micro-architecture blindly uses the address in the program counter to fetch and execute instructions without validating its legitimacy. Whenever this blind-folded instruction sequencing is not properly addressed at a higher level by system, it becomes a vulnerability of control data attacks, today's dominant and most critical security threats. To remedy it, this paper proposes a micro-architectural mechanism to validate control flow transfer at run-time at machine instruction level. It is proposed to have a hardware table consisting of legitimate indirect branches and their target pairs (IBPs) to aid the validation. The IBP table is implemented in the form of a cascading Bloom filter to store the security information as well as to enable fast validating. Based on a key observation that branch prediction unit existing in most speculative-execution processors already provides a portion of the control flow validation, our scheme activates the validation only on indirect br...

• Type: Conference
• Year: 2006
• Where: ICCD
• Authors: Yixin Shi, Sean Dempsey, Gyungho Lee
• Keywords: Cascading Bloom Filter, Control Flow Validation, Hardware, ICCD 2006, Legitimate Indirect Branches