loading...
A Hardware-Software Platform for Intrusion Prevention
Portland,Oregon December 04-December 08
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/MICRO.2004.237th Annual IEEE/ACM International Sy ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Milenko Drinic, Microsoft Research
Darko Kirovski, Microsoft Research
Preventing execution of unauthorized software on a given computer plays a pivotal role in system security. The key problem is that although a program at the beginning of its execution can be verified as authentic, its execution flow can be redirected to externally injected malicious code using, for example, a buffer overflow exploit.
We introduce a novel, simplified, hardware-assisted intrusion prevention platform. Our platform introduces overlapping of program execution and MAC verification. It partitions a program binary into blocks of instructions. Each block is signed using a keyed MAC that is attached as a footer to the block. When the control flow reaches a particular block, its instructions are speculatively executed, while dedicated hardware verifies the attached MAC at run-time. The computation state is preserved during speculative execution using a mediating buffer placed between the processor and L1 data cache. Upon MAC verification, the results from this buffer are propagated externally. Central to this paper is the proposal of a novel optimization technique that initially identifies instructions that are likely to stall execution, and reorders basic blocks within a given instruction block to minimize the execution overhead. While the presented optimization technique is problem specific, it is flexible such that it can be adjusted for different optimization goals. Preliminary results showed that our optimization methods produced an average overhead reduction of 60% on the SPEC2000 benchmark suite and Microsoft Visual FoxPro.
Citation:
Milenko Drinic, Darko Kirovski, "A Hardware-Software Platform for Intrusion Prevention," micro, pp.233-242, 37th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO'04), 2004
Usage of this product signifies your acceptance of the Terms of Use.