Dynamic Information Flow Tracking - Revision history

Jcmartinez: /* The General Idea */

2012-03-28T18:51:35Z

The General Idea

← Older revision		Revision as of 18:51, 28 March 2012
Line 5:		Line 5:

	== The General Idea ==		== The General Idea ==
-	[[File:pift-idea.png \|thumb\|right\|350px\|~~The architecture support in processor pipeline for control flow validation~~]]	+	[[File:pift-idea.png \|thumb\|right\|350px\|Virtual adreess space and page table on PIFT]]

	== The Architectural Design ==		== The Architectural Design ==

Jcmartinez: /* The General Idea */

2012-03-28T18:51:08Z

The General Idea

← Older revision		Revision as of 18:51, 28 March 2012
Line 5:		Line 5:

	== The General Idea ==		== The General Idea ==
-	[[File:~~architecture~~.png \|thumb\|right\|350px\|The architecture support in processor pipeline for control flow validation]]	+	[[File:pift-idea.png \|thumb\|right\|350px\|The architecture support in processor pipeline for control flow validation]]

	== The Architectural Design ==		== The Architectural Design ==

Jcmartinez: /* The Architectural Design */

2012-03-28T18:50:25Z

The Architectural Design

← Older revision		Revision as of 18:50, 28 March 2012
Line 8:		Line 8:

	== The Architectural Design ==		== The Architectural Design ==
		+	[[File:pift-architecture.png \|thumb\|right\|350px\|Architecture design]]

	== People ==		== People ==

Jcmartinez: /* The General Idea */

2012-03-28T18:49:44Z

The General Idea

← Older revision		Revision as of 18:49, 28 March 2012
Line 5:		Line 5:

	== The General Idea ==		== The General Idea ==
		+	[[File:architecture.png \|thumb\|right\|350px\|The architecture support in processor pipeline for control flow validation]]

	== The Architectural Design ==		== The Architectural Design ==

Jcmartinez: /* Publications */

2012-03-28T18:48:58Z

Publications

← Older revision		Revision as of 18:48, 28 March 2012
Line 13:		Line 13:

	== Publications ==		== Publications ==
		+
		+	*J. C. Martinez Santos, Y. Fei, and Z. J. Shi, “PIFT: Efficient dynamic information flow tracking using secure page allocation,” in WkShp on Embedded System Security (WESS) (held in conjunction with Embedded Systems Week), Oct. 2009.

Jcmartinez: /* Abstract */

2012-03-28T18:48:15Z

Abstract

← Older revision		Revision as of 18:48, 28 March 2012
Line 2:		Line 2:

	Dynamic information flow tracking (DIFT) is an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffer large performance degradation, and hardware approaches have high logic and storage overhead. In this paper, we propose a flexible and light-weight hardware/software co-design approach to perform DIFT based on secure page allocation. Instead of associating every data with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in separate memory pages. Our approach is a compiler-aided process with architecture support. The implementation and analysis show that the memory overhead is little, and our approach can protect critical information, including return address, indirect jump address, and system call IDs, from being overwritten by malicious users.		Dynamic information flow tracking (DIFT) is an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffer large performance degradation, and hardware approaches have high logic and storage overhead. In this paper, we propose a flexible and light-weight hardware/software co-design approach to perform DIFT based on secure page allocation. Instead of associating every data with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in separate memory pages. Our approach is a compiler-aided process with architecture support. The implementation and analysis show that the memory overhead is little, and our approach can protect critical information, including return address, indirect jump address, and system call IDs, from being overwritten by malicious users.
		+
		+
		+	== The General Idea ==
		+
		+	== The Architectural Design ==
		+
		+	== People ==
		+
		+	* [[ Juan Carlos Martinez Santos]]
		+
		+	== Publications ==

Jcmartinez: /* Abstract */

2012-03-28T18:38:09Z

Abstract

← Older revision		Revision as of 18:38, 28 March 2012
Line 1:		Line 1:
	== Abstract ==		== Abstract ==

-	Dynamic information flow tracking (DIFT) ~~has been~~ an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches ~~suffers from~~ large performance degradation and hardware approaches have ~~great~~ logic and storage overhead.	+	Dynamic information flow tracking (DIFT) is an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffer large performance degradation, and hardware approaches have high logic and storage overhead. In this paper, we propose a flexible and light-weight hardware/software co-design approach to perform DIFT based on secure page allocation. Instead of associating every data with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in separate memory pages. Our approach is a compiler-aided process with architecture support. The implementation and analysis show that the memory overhead is little, and our approach can protect critical information, including return address, indirect jump address, and system call IDs, from being overwritten by malicious users.
-		+
-	We propose a flexible~~, efficient,~~ and light-weight approach to perform DIFT based on secure page allocation~~, PIFT~~. Instead of associating ~~each~~ data ~~value~~ with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in ~~different types of~~ memory pages.	+
-		+
-	Our approach is a ~~compile~~-aided process ~~that allows the compiler to allocate trusted/untrusted information into different memory pages~~. ~~Our~~ implementation and analysis show that the memory overhead is little, and ~~the~~ approach can protect critical information, ~~like~~ return address, indirect jump address, and system call ~~arguments~~, from being overwritten by malicious ~~data~~.	+

Jcmartinez: /* Abstract */

2011-06-27T19:26:33Z

Abstract

← Older revision		Revision as of 19:26, 27 June 2011
Line 1:		Line 1:
	== Abstract ==		== Abstract ==

-	Dynamic information flow tracking (DIFT) has been an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffers from large performance degradation and hardware approaches have great logic and storage overhead. ~~In this paper, we~~ propose a flexible, efficient, and light-weight approach to perform DIFT based on secure page allocation, PIFT. Instead of associating each data value with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in different types of memory pages. Our approach is a compile-aided process that allows the compiler to allocate trusted/untrusted information into different memory pages. Our implementation and analysis show that the memory overhead is little, and the approach can protect critical information, like return address, indirect jump address, and system call arguments, from being overwritten by malicious data.	+	Dynamic information flow tracking (DIFT) has been an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffers from large performance degradation and hardware approaches have great logic and storage overhead.
		+
		+	We propose a flexible, efficient, and light-weight approach to perform DIFT based on secure page allocation, PIFT. Instead of associating each data value with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in different types of memory pages.
		+
		+	Our approach is a compile-aided process that allows the compiler to allocate trusted/untrusted information into different memory pages. Our implementation and analysis show that the memory overhead is little, and the approach can protect critical information, like return address, indirect jump address, and system call arguments, from being overwritten by malicious data.

Jcmartinez: Created page with '== Abstract == Dynamic information flow tracking (DIFT) has been an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. Howe…'

2011-06-27T19:20:38Z

Created page with '== Abstract == Dynamic information flow tracking (DIFT) has been an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. Howe…'

New page

== Abstract ==

Dynamic information flow tracking (DIFT) has been an effective security countermeasure for both low-level memory corruptions and high-level semantic attacks. However, many software approaches suffers from large performance degradation and hardware approaches have great logic and storage overhead. In this paper, we propose a flexible, efficient, and light-weight approach to perform DIFT based on secure page allocation, PIFT. Instead of associating each data value with a taint tag, we aggregate data according to their taints, i.e., putting data with different attributes in different types of memory pages. Our approach is a compile-aided process that allows the compiler to allocate trusted/untrusted information into different memory pages. Our implementation and analysis show that the memory overhead is little, and the approach can protect critical information, like return address, indirect jump address, and system call arguments, from being overwritten by malicious data.