HDFI: Hardware-Assisted Data-Flow Isolation

Citations Over TimeTop 1% of 2016 papers

Abstract

Memory corruption vulnerabilities are the root cause of many modern attacks. Existing defense mechanisms are inadequate; in general, the software-based approaches are not efficient and the hardware-based approaches are not flexible. In this paper, we present hardware-assisted data-flow isolation, or, HDFI, a new fine-grained data isolation mechanism that is broadly applicable and very efficient. HDFI enforces isolation at the machine word granularity by virtually extending each memory unit with an additional tag that is defined by dataflow. This capability allows HDFI to enforce a variety of security models such as the Biba Integrity Model and the Bell -- LaPadula Model. We implemented HDFI by extending the RISC-V instruction set architecture (ISA) and instantiating it on the Xilinx Zynq ZC706 evaluation board. We ran several benchmarks including the SPEC CINT 2000 benchmark suite. Evaluation results show that the performance overhead caused by our modification to the hardware is low (<; 2%). We also developed or ported several security mechanisms to leverage HDFI, including stack protection, standard library enhancement, virtual function table protection, code pointer protection, kernel data protection, and information leak prevention. Our results show that HDFI is easy to use, imposes low performance overhead, and allows us to create more elegant and more secure solutions.

Related Papers

• → Accelerating the Task Activation and Data Communication for Dataflow Computing(2022)1 cited
• Design and Simulation of Data Flow Architecture Based on Petri Nets(2004)
• Data Flow Analysis Based on the Variable Scope(2012)
• → An Improved Method of Signal Processing Platform Component Model(2016)
• → Research on the development and challenges of dataflow processing technology(2023)