Pointing in the Right Direction - Securing Memory Accesses in a Faulty World

by   Robert Schilling, et al.

Reading and writing memory are, besides computation, the most common operations a processor performs. The correctness of these operations is therefore essential for the proper execution of any program. However, as soon as fault attacks are considered, assuming that the hardware performs its memory operations as instructed is not valid anymore. In particular, attackers may induce faults with the goal of reading or writing incorrectly addressed memory, which can have various critical safety and security implications. In this work, we present a solution to this problem and propose a new method for protecting every memory access inside a program against address tampering. The countermeasure comprises two building blocks. First, every pointer inside the program is redundantly encoded using a multi-residue error detection code. The redundancy information is stored in the unused upper bits of the pointer with zero overhead in terms of storage. Second, load and store instructions are extended to link data with the corresponding encoded address from the pointer. Wrong memory accesses subsequently infect the data value allowing the software to detect the error. For evaluation purposes, we implemented our countermeasure into a RISC-V processor, tested it on a FPGA development board, and evaluated the induced overhead. Furthermore, a LLVM-based C compiler has been modified to automatically encode all data pointers, to perform encoded pointer arithmetic, and to emit the extended load/store instructions with linking support. Our evaluations show that the countermeasure induces an average overhead of 10 terms of code size and 7 practical adoption.


page 1

page 2

page 3

page 4


CIDPro: Custom Instructions for Dynamic Program Diversification

Timing side-channel attacks pose a major threat to embedded systems due ...

Silhouette: Efficient Intra-Address Space Isolation for Protected Shadow Stacks on Embedded Systems

Embedded systems are increasingly deployed in devices that can have phys...

Louvre: Lightweight Ordering Using Versioning for Release Consistency

Fence instructions are fundamental primitives that ensure consistency in...

On Consistency for Bulk-Bitwise Processing-in-Memory

Processing-in-memory (PIM) architectures allow software to explicitly in...

Securing Conditional Branches in the Presence of Fault Attacks

In typical software, many comparisons and subsequent branch operations a...

Adding Explicit Load-Acquire and Store-Release Instructions to the RISC-V ISA

Weak memory models allow for simplified hardware and increased performan...

S3Library: Automatically Eliminating C/C++ Buffer Overflow using Compatible Safer Libraries

Annex K of C11, bounds-checking interfaces, recently introduced a set of...

Please sign up or login with your details

Forgot password? Click here to reset