Optimized data-flow integrity for modern compilers

Vista sencilla de ítem
dc.contributor.authorDíez Franco, Irene
dc.contributor.authorUgarte Pedrero, Xabier
dc.contributor.authorGarcía Bringas, Pablo
dc.date.accessioned2025-03-05T07:57:33Z
dc.date.available2025-03-05T07:57:33Z
dc.date.issued2024
dc.date.updated2025-03-05T07:57:33Z
dc.description.abstractNon-control-data attacks are those attacks that purely target and modify the non-control data of a program, such as boolean values, user input or configuration parameters, and leave the control flow of a program untouched. These attacks were considered a niche due to the high difficulty in crafting attacks that do not modify the control flow. However, in recent years researchers have already demonstrated that non-control-data attacks can be automatically constructed and that they pose a significant threat because they can compromise critical and widely used software, such as web browsers and the Linux kernel. Moreover, they can also be used to disable or bypass state-of-the-art software security techniques, such as control-flow integrity. The most promising technique to protect against non-control-data attacks is data-flow integrity, however, modern compilers do not implement this protection yet. In this work we present an optimized data-flow integrity implementation for modern compilers that reduces the amount of basic blocks that need to be protected in an average of 45.8%, it also has broader security guarantees due to its more precise static analysis. Finally, we evaluate the completeness of our optimized data-flow integrity implementation.en
dc.description.sponsorshipThis work was supported in part by the Elkartek CERBERO Project of Basque Government under Grant KK-2024/00022. The work of Irene Díez-Franco was supported in part by the Pre-Doctoral Grant by the Basque Governmenten
dc.identifier.citationDíez-Franco, I., Ugarte-Pedrero, X., & García-Bringas, P. (2024). Optimized Data-Flow Integrity for Modern Compilers. IEEE Access, 12, 124171-124182. https://doi.org/10.1109/ACCESS.2024.3454551
dc.identifier.doi10.1109/ACCESS.2024.3454551
dc.identifier.eissn2169-3536
dc.identifier.urihttps://hdl.handle.net/20.500.14454/2452
dc.language.isoeng
dc.publisherInstitute of Electrical and Electronics Engineers Inc.
dc.rights© 2024 The Authors
dc.subject.otherCompilers
dc.subject.otherData-flow integrity
dc.subject.otherNon-control-data attacks
dc.subject.otherProgram analysis
dc.subject.otherSecurity vulnerabilities
dc.subject.otherSystems security
dc.titleOptimized data-flow integrity for modern compilersen
dc.typejournal article
dcterms.accessRightsopen access
oaire.citation.endPage124182
oaire.citation.startPage124171
oaire.citation.titleIEEE Access
oaire.citation.volume12
oaire.licenseConditionhttps://creativecommons.org/licenses/by/4.0/
oaire.versionVoR
Archivos
Bloque original
Mostrando 1 - 1 de 1
Miniatura
Nombre:
diez_optimized_2024.pdf
Tamaño:
743.59 KB
Formato:
Adobe Portable Document Format
Descargar
Colecciones
Artículos