Abstract:Nowadays, code reuse attacks impose a substantial threat to the security of operating system kernels. Control-flow graph-based CFI techniques, while effective, bring considerable performance overhead, thus limiting their practical adoption in real-world products. As an alternative approach, recent research suggests safeguarding the integrity of sensitive pointers as a countermeasure against manipulation attempts. Unfortunately, existing pointer integrity protection schemes only protect sensitive pointers partially and ignore assembly code, leaving protection gaps. To fill up these protection gaps, we propose a novel security concept named full life-cycle integrity , which enforces the integrity of a sensitive pointer at every step on its value flow chain. To realize full life-cycle integrity, we propose three novel techniques, including assembly-aware sensitivity for analyzing assembly code, Merkle PAC tree for protecting interrupt context securely and efficiently, and pointer-grained authentication for defeating spatial substitution attacks. We have developed a practical implementation of comprehensive life-cycle integrity for the Linux kernel, called ”kernel Code Pointer Authentication” (kCPA), which leverages the ARM Pointer Authentication (PAuth) mechanism. This implementation has been extended to the Apple M1 architecture for real-world evaluation on PAuth hardware. Our assessment demonstrates that kCPA effectively mitigates a range of real-world attacks while incurring a minimal 2.5% performance overhead for the Phoronix Test Suite and nearly negligible performance impact for SPEC2017 benchmarks.

An OS Security Protection Model for Defeating Attacks from Network

Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

SoK: A Minimalist Approach to Formalizing Analog Sensor Security.

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

Stochastic Stability Analysis of Networked Control Systems with Random Cryptographic Protection under Random Zero-Measurement Attacks

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Process Stability Modeling and Attack Protection of Industrial Control System Based on Reverse Cloud Algorithm Model

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Attacks on Data-Driven Process Monitoring Systems: Subspace Transfer Networks

Generalized Taint Propagation Model for Access Control in Operation Systems

Secguard: Secure And Practical Integrity Protection Model For Operating Systems

A Multi-Protection Domains Process Model and Its Implementation

Event-Triggered Security Output Feedback Control for Networked Interconnected Systems Subject to Cyber-Attacks

T-MAC: Protecting Mandatory Access Control System Integrity from Malicious Execution Environment on ARM-Based Mobile Devices

Method to Efficiently Protect Applications from Untrusted OS Kernel

S3A: Secure System Simplex Architecture for Enhanced Security of Cyber-Physical Systems

A Stochastic Model for Quantitative Security Analyses of Networked Systems.

Probabilistic models for evaluating network edge's resistance against scan and foothold attack

TMAC: Taint-based memory protection via access control

Security Analysis of Compromised-Neighbor-Tolerant Networks Using Stochastics