Nanovised Control Flow Attestation
Source abstract
Abstract
This paper presents an improvement of control flow attestation (C-FLAT) for Linux. C-FLAT is a control attestation system for embedded devices. It was implemented as a software executing in ARM’s TrustZone on bare-metal devices. We extend the design and implementation of C-FLAT through the use of a type 2 Nanovisor in the Linux operating system. We call our improved system “C-FLAT Linux”. Compared to the original C-FLAT, C-FLAT Linux reduces processing overheads and is able to detect the SlowLoris attack. We describe the architecture of C-FLAT Linux and provide extensive measurements of its performance in benchmarks and real-world scenarios. In addition, we demonstrate the detection of the SlowLoris attack on the Apache web server.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Advanced Malware Detection Techniques · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Faculty of Information Technology, University of Jyväskylä, 40014 Jyväskylä, Finland
Department of Software Engineering, Shamoon College of Engineering, Beer-Sheva 8410802, Israel
Faculty of Computer Science, College of Management Academic Studies, Rishon LeZion 7579806, Israel
References (52)
Show source-provided references
1. Abera, T., Asokan, N., Davi, L., Ekberg, J.E., Nyman, T., Paverd, A., Sadeghi, A.R., and Tsudik, G. (2016, January 24–28). C-FLAT: Control-flow attestation for embedded systems software. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria.10.1145/2976749.2978358 ↗
2. Protection against reverse engineering in ARM10.1007/s10207-019-00450-1 ↗
3. Flur, S., Gray, K.E., Pulte, C., Sarkar, S., Sezgin, A., Maranget, L., Deacon, W., and Sewell, P. (2016, January 20–22). Modelling the ARMv8 architecture, operationally: Concurrency and ISA. Proceedings of the 43rd Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, St. Petersburg, FL, USA.10.1145/2837614.2837615 ↗
4. Tice, C., Roeder, T., Collingbourne, P., Checkoway, S., Erlingsson, Ú., Lozano, L., and Pike, G. (2014, January 20–22). Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM. Proceedings of the 23rd USENIX Security Symposium (USENIX Security 14), San Diego, CA, USA.
5. Control-flow integrity principles, implementations, and applications10.1145/1609956.1609960 ↗
6. Dessouky, G., Zeitouni, S., Nyman, T., Paverd, A., Davi, L., Koeberl, P., Asokan, N., and Sadeghi, A.R. (2017, January 18–22). Lo-fat: Low-overhead control flow attestation in hardware. Proceedings of the 54th Annual Design Automation Conference 2017, Austin, TX, USA.10.1145/3061639.3062276 ↗
7. Clements, A.A., Almakhdhub, N.S., Saab, K.S., Srivastava, P., Koo, J., Bagchi, S., and Payer, M. (2017, January 22–26). Protecting bare-metal embedded systems with privilege overlays. Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.10.1109/SP.2017.37 ↗
8. Vaidya, J., Zhang, X., and Li, J. (2019). Log-Based Control Flow Attestation for Embedded Devices. Cyberspace Safety and Security, Springer International Publishing.
9. Zhang, Y., Liu, X., Sun, C., Zeng, D., Tan, G., Kan, X., and Ma, S. (2021). ReCFA: Resilient Control-Flow Attestation. Annual Computer Security Applications Conference, Association for Computing Machinery.10.1145/3485832.3485900 ↗
10. De Oliveira Nunes, I., Jakkamsetti, S., and Tsudik, G. (2021, January 1–5). Tiny-CFA: Minimalistic Control-Flow Attestation Using Verified Proofs of Execution. Proceedings of the 2021 Design, Automation Test in Europe Conference Exhibition (DATE), Grenoble, France.10.23919/DATE51398.2021.9474029 ↗
11. Hu, J., Huo, D., Wang, M., Wang, Y., Zhang, Y., and Li, Y. (2019, January 5–8). A Probability Prediction Based Mutable Control-Flow Attestation Scheme on Embedded Platforms. Proceedings of the 2019 18th IEEE International Conference On Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), Rotorua, New Zealand.10.1109/TrustCom/BigDataSE.2019.00077 ↗
12. Moreira, J., Rigo, S., Polychronakis, M., and Kemerlis, V.P. (2022, February 17). Drop the Rop Fine-Grained Control-Flow Integrity for the Linux Kernel. Black Hat Asia. Available online: https://www.blackhat.com/docs/asia-17/materials/asia-17-Moreira-Drop-The-Rop-Fine-Grained-Control-Flow-Integrity-For-The-Linux-Kernel-wp.pdf.
13. Davi, L., Dmitrienko, A., Egele, M., Fischer, T., Holz, T., Hund, R., Nürnberger, S., and Sadeghi, A.R. (2012, January 5–8). MoCFI: A Framework to Mitigate Control-Flow Attacks on Smartphones. Proceedings of the NDSS, San Diego, CA, USA.
14. Van der Veen, V., Andriesse, D., Göktaş, E., Gras, B., Sambuc, L., Slowinska, A., Bos, H., and Giufida, C. (2015, January 12–16). Practical context-sensitive CFI. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, Denver, CO, USA.10.1145/2810103.2813673 ↗
15. kBouncer: Efficient and transparent ROP mitigation
16. Seshadri, A., Perrig, A., Van Doorn, L., and Khosla, P. (2004, January 12). SWATT: Software-based attestation for embedded devices. Proceedings of the IEEE Symposium on Security and Privacy, Berkeley, CA, USA.
17. Seshadri, A., Luk, M., Shi, E., Perrig, A., Van Doorn, L., and Khosla, P. (2005, January 23–26). Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. Proceedings of the Twentieth ACM Symposium on Operating Systems Principles, Brighton, UK.10.1145/1095810.1095812 ↗
18. Li, Y., McCune, J.M., and Perrig, A. (2011, January 17–21). VIPER: Verifying the integrity of PERipherals’ firmware. Proceedings of the 18th ACM Conference on Computer and Communications Security, Chicago, IL, USA.10.1145/2046707.2046711 ↗
19. Eldefrawy, K., Tsudik, G., Francillon, A., and Perito, D. (2012, January 5–8). SMART: Secure and Minimal Architecture for (Establishing Dynamic) Root of Trust. Proceedings of the NDSS, San Diego, CA, USA.
20. Koeberl, P., Schulz, S., Sadeghi, A.R., and Varadharajan, V. (2014, January 14–16). TrustLite: A security architecture for tiny embedded devices. Proceedings of the Ninth European Conference on Computer Systems, Amsterdam, The Netherlands.10.1145/2592798.2592824 ↗
21. Brasser, F., El Mahjoub, B., Sadeghi, A.R., Wachsmann, C., and Koeberl, P. (2015, January 8–12). TyTAN: Tiny trust anchor for tiny devices. Proceedings of the 52nd Annual Design Automation Conference, San Francisco, CA, USA.10.1145/2744769.2744922 ↗
22. Zhang, C., Wei, T., Chen, Z., Duan, L., Szekeres, L., McCamant, S., Song, D., and Zou, W. (2013, January 19–22). Practical control flow integrity and randomization for binary executables. Proceedings of the 2013 IEEE Symposium on Security and Privacy, Berkeley, CA, USA.
23. Zhang, M., and Sekar, R. (2013, January 14–16). Control flow integrity for COTS binaries. Proceedings of the 22nd USENIX Security Symposium (USENIX Security 13), Washington, DC, USA.
24. Kuznetzov, V., Szekeres, L., Payer, M., Candea, G., Sekar, R., and Song, D. (2018). Code-pointer integrity. The Continuing Arms Race: Code-Reuse Attacks and Defenses, ACM.10.1145/3129743.3129748 ↗
25. Evans, I., Fingeret, S., Gonzalez, J., Otgonbaatar, U., Tang, T., Shrobe, H., Sidiroglou-Douskos, S., Rinard, M., and Okhravi, H. (2015, January 17–21). Missing the point (er): On the effectiveness of code pointer integrity. Proceedings of the 2015 IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2015.53 ↗
26. Nagarajan, A., Varadharajan, V., Hitchens, M., and Gallery, E. (2009, January 19–21). Property based attestation and trusted computing: Analysis and challenges. Proceedings of the 2009 Third International Conference on Network and System Security, Gold Coast, QLD, Australia.10.1109/NSS.2009.83 ↗
27. Sadeghi, A.R., and Stüble, C. (2004, January 20–23). Property-based attestation for computing platforms: Caring about properties, not mechanisms. Proceedings of the 2004 Workshop on New Security Paradigms, Victoria, BC, Canada.10.1145/1065907.1066038 ↗
28. Chen, L., Landfermann, R., Löhr, H., Rohe, M., Sadeghi, A.R., and Stüble, C. (2006, January 3). A protocol for property-based attestation. Proceedings of the First ACM Workshop on Scalable Trusted Computing, Alexandria, VA, USA.10.1145/1179474.1179479 ↗
29. Seshadri, A., Luk, M., Qu, N., and Perrig, A. (2007, January 14–17). SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes. Proceedings of the Twenty-First ACM SIGOPS Symposium on Operating Systems Principles, Stevenson, WA, USA.10.1145/1294261.1294294 ↗
30. A kernel stack protection model against attacks from kernel execution units10.1016/j.cose.2017.09.008 ↗
31. MOSKG: Countering kernel rootkits with a secure paging mechanism10.1002/sec.1282 ↗
32. Azab, A.M., Ning, P., Sezer, E.C., and Zhang, X. (2009, January 7–11). HIMA: A hypervisor-based integrity measurement agent. Proceedings of the 2009 Annual Computer Security Applications Conference, Honolulu, HI, USA.10.1109/ACSAC.2009.50 ↗
33. Khen, E., Zaidenberg, N.J., Averbuch, A., and Fraimovitch, E. (2013, January 7–10). Lgdb 2.0: Using lguest for kernel profiling, code coverage and simulation. Proceedings of the 2013 International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS), Toronto, ON, Canada.
34. Zaidenberg, N.J., and Khen, E. (2015, January 3–5). Detecting kernel vulnerabilities during the development phase. Proceedings of the 2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing, New York, NY, USA.10.1109/CSCloud.2015.91 ↗
35. Kiperberg, M., Leon, R., Resh, A., Algawi, A., and Zaidenberg, N. (2019). Hypervisor-assisted Atomic Memory Acquisition in Modern Systems. International Conference on Information Systems Security and Privacy, SCITEPRESS Science And Technology Publications.10.5220/0007566101550162 ↗
36. Ligh, M.H., Case, A., Levy, J., and Walters, A. (2014). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory, John Wiley & Sons.
37. Memory forensics: The path forward10.1016/j.diin.2016.12.004 ↗
38. Aljaedi, A., Lindskog, D., Zavarsky, P., Ruhl, R., and Almari, F. (2011, January 9–11). Comparative analysis of volatile memory forensics: Live response vs. memory imaging. Proceedings of the 2011 IEEE Third International Conference on Privacy, Security, Risk and Trust and 2011 IEEE Third International Conference on Social Computing, Boston, MA, USA.10.1109/PASSAT/SocialCom.2011.68 ↗
39. Lu, S., Lin, Z., and Zhang, M. (2019, January 23–25). Kernel Vulnerability Analysis: A Survey. Proceedings of the 2019 IEEE Fourth International Conference on Data Science in Cyberspace (DSC), Hangzhou, China.10.1109/DSC.2019.00089 ↗
40. Lu, H. (2022, February 17). Elf: From the Programmer’s Perspective. Available online: https://www.linux.co.cr/free-unix-os/review/acrobat/950517.pdf.
41. Drepper, U., and Molnar, I. (2022, February 17). The Native POSIX thread Library for Linux. Available online: https://www.cs.utexas.edu/~witchel/372/lectures/POSIX_Linux_Threading.pdf.
42. Ben Yehuda, R., and Zaidenberg, N. (2018, January 4–7). Hyplets-Multi Exception Level Kernel towards Linux RTOS. Proceedings of the 11th ACM International Systems and Storage Conference, Haifa, Israel.10.1145/3211890.3211917 ↗
43. Ben Yehuda, R., and Zaidenberg, N. (2020, January 20–22). The hyplet-Joining a Program and a Nanovisor for real-time and Performance. Proceedings of the SPECTS, the 2020 International Symposium on Performance Evaluation of Computer and Telecommunication Systems Conference, Madrid, Spain.
44. KVM/ARM: The design and implementation of the linux ARM hypervisor10.1145/2654822.2541946 ↗
45. (2022, February 17). Open Portable Trusted Execution Environment. Available online: https://www.op-tee.org/.
46. Corbet, J. (2022, February 17). BPF Comes to Firewalls. Available online: https://lwn.net/Articles/747551/#:~:text=The%20use%20of%20BPF%20enables,security%20to%20the%20whole%20system.
47. Wang, Z., and Jiang, X. (2010, January 16–19). Hypersafe: A lightweight approach to provide lifetime hypervisor control-flow integrity. Proceedings of the 2010 IEEE Symposium on Security and Privacy, Oakland, CA, USA.10.1109/SP.2010.30 ↗
48. (2022, February 17). AdvanceCOMP. Available online: http://www.advancemame.it/.
49. Damon, E., Dale, J., Laron, E., Mache, J., Land, N., and Weiss, R. (2012, January 12–13). Hands-on denial of service lab exercises using slowloris and rudy. Proceedings of the 2012 Information Security Curriculum Development Conference, Kennesaw, GA, USA.10.1145/2390317.2390321 ↗
50. Slow DoS attacks: Definition and categorisation10.1504/IJTMCC.2013.056440 ↗
51. Aulds, C. (2002). Linux Apache Web Server Administration, Sybex.
52. (2022, February 17). SlowHttpTest Linux Man Page. Available online: https://linux.die.net/man/1/slowhttptest.