SecDINT: Preventing Data-oriented Attacks via Intel SGX Escorted Data Integrity
2023 IEEE Conference on Communications and Network Security (CNS)(2023)
摘要
Data-oriented attacks with the intent to corrupt critical memory data without violating Control-flow Integrity (CFI) pose significant threats to legitimate program execution. Existing mitigations predominantly rely on software-based memory safety measures to ensure critical data integrity, a solution often associated with elevated performance overhead and susceptibility to intricate attack techniques. In this paper, we present a CPU level data integrity design, named Intel SGX Escorted Data Integrity (SecDINT), to automatically protect sensitive variables against data-oriented attacks. Our design can achieve the data integrity of sensitive variables via SGX enforced isolation in binaries. We evaluate SecDINT on real-world applications. The results reveal that SecDINT can effectively identify sensitive variables, enforce data integrity, and prevent data-oriented attacks. Comparative analysis with existing software-based strategies (e.g., 103% runtime overhead in Data-flow Integrity, 116% in SoftBound with CETS), showcased SecDINT’s remarkable capability in drastically reducing overhead to as low as 20.1%.
更多查看译文
关键词
Data-oriented Attacks,Data Integrity,Data-flow Integrity,Intel SGX,Data Enclave
AI 理解论文
溯源树
样例
![](https://originalfileserver.aminer.cn/sys/aminer/pubs/mrt_preview.jpeg)
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要