Secure program execution via dynamic information flow tracking

Dynamic information flow tracking is a hardware mechanism to protect programs against malicious attacks by identifying spurious information flows and restricting the usage of spurious information. Every security attack to take control of a program needs to transfer the program’s control to malevolent code. In our approach, the operating system identifies a set of input channels as spurious, and the processor tracks all information flows from those inputs. A broad range of attacks are effectively defeated by disallowing the spurious data to be used as instructions or jump target addresses. We describe two different security policies that track differing sets of dependencies. Implementing the first policy only incurs, on average, a memory overhead of 0.26% and a performance degradation of 0.02%. This policy does not require any modification of executables. The stronger policy incurs, on average, a memory overhead of 4.5% and a performance degradation of 0.8%, and requires binary...

• Type: Conference
• Year: 2004
• Where: ASPLOS
• Authors: G. Edward Suh, Jae W. Lee, David Zhang, Srinivas Devadas
• Keywords: ASPLOS 2004, Information flows, Programming Languages, Spurious Information, Spurious Information flows