Hardware-Based Instruction Set Randomization Against Code Injection Attacks

Code injection attacks continue a realistic threat to cyberspace security, as they can exploit vulnerabilities and execute arbitrary code. Instruction Set Randomization (ISR) can prevent code injection attacks by providing dynamic and random instruction set for the running program. However, the existing ISR implementations have defects in practicality and security. Software-based ISR incurs significant performance loss and the risk of bypassing ISR protection. Code segment of ELF binary may be mixed with data, but stripping data from the code segment is hard to accomplish. There is also lack of universal methods to introduce ISR technology into the kernel and applications security protection.We improve the Bochs prototype and propose a new hardware-based ISR framework for RISC architectures with CPU, compiler, boot loader, kernel and executable file. We implement instruction translation and random key generation in the CPU. We design and realize compiler-generated static ISR method and dynamic ISR method based on code region information. We select OpenRisc processor and Linux kernel to implement static and dynamic ISR for the kernel and applications. The experimental results show that ISR can prevent kernel and applications from code injection attacks with less than 0.7% runtime overhead and less than 2% additional hardware. We can conclude that the security of kernel and applications will be improved with negligible cost due to the use of hardware-based ISR.