Visible to the public A FPGA-based Control-Flow Integrity Solution for Securing Bare-Metal Embedded Systems

TitleA FPGA-based Control-Flow Integrity Solution for Securing Bare-Metal Embedded Systems
Publication TypeConference Paper
Year of Publication2020
AuthorsMaunero, Nicoló, Prinetto, Paolo, Roascio, Gianluca, Varriale, Antonio
Conference Name2020 15th Design Technology of Integrated Systems in Nanoscale Era (DTIS)
Keywordsbackward edges, bare-metal, code-reuse attacks, composability, Embedded systems, firmware, forward edges, human factors, interrupt, JOP, microcontrollers, pubcrawl, Resiliency, return-oriented programming, ROP, rop attacks, Scalability, security
AbstractMemory corruption vulnerabilities, mainly present in C and C++ applications, may enable attackers to maliciously take control over the program running on a target machine by forcing it to execute an unintended sequence of instructions present in memory. This is the principle of modern Code-Reuse Attacks (CRAs) and of famous attack paradigms as Return-Oriented Programming (ROP) and Jump-Oriented Programming (JOP). Control-Flow Integrity (CFI) is a promising approach to protect against such runtime attacks. Recently, many CFI-based solutions have been proposed, resorting to both hardware and software implementations. However, many of these solutions are hardly applicable to microcontroller systems, often very resource-limited. The paper presents a generic, portable, and lightweight CFI solution for bare-metal embedded systems, i.e., systems that execute firmware directly from their Flash memory, without any Operating System. The proposed defense mixes software and hardware instrumentation and is based on monitoring the Control-Flow Graph (CFG) with an FPGA connected to the CPU. The solution, applicable in principle to any architecture which disposes of an FPGA, forces all control-flow transfers to be compliant with the CFG, and preserves the execution context from possible corruption when entering unpredictable code such as Interrupt Services Routines (ISR).
DOI10.1109/DTIS48698.2020.9081314
Citation Keymaunero_fpga-based_2020