English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

With the improvements in computing technologies, edge devices in theInternet-of-Things have become more complex. The enabler technology for thesecomplex systems are powerful application core processors with operating systemsupport, such as Linux. While the isolation of applications through theoperating system increases the security, the interface to the kernel poses anew threat. Different attack vectors, including fault attacks and memoryvulnerabilities, exploit the kernel interface to escalate privileges and takeover the system.  In this work, we present SFP, a mechanism to protect the execution of systemcalls against software and fault attacks providing integrity to user-kerneltransitions. SFP provides system call flow integrity by a two-step linkingapproach, which links the system call and its origin to the state ofcontrol-flow integrity. A second linking step within the kernel ensures thatthe right system call is executed in the kernel. Combining both linking stepsensures that only the correct system call is executed at the right location inthe program and cannot be skipped. Furthermore, SFP provides dynamic CFIinstrumentation and a new CFI checking policy at the edge of the kernel toverify the control-flow state of user programs before entering the kernel. Weintegrated SFP into FIPAC, a CFI protection scheme exploiting ARM pointerauthentication. Our prototype is based on a custom LLVM-based toolchain with aninstrumented runtime library combined with a custom Linux kernel to protectsystem calls. The evaluation of micro- and macrobenchmarks based on SPEC 2017show an average runtime overhead of 1.9 % and 20.6 %, which is only an increaseof 1.8 % over plain control-flow protection. This small impact on theperformance shows the efficiency of SFP for protecting all system calls andproviding integrity for the user-kernel transitions.

SFP: Providing System Call Flow Protection against Software and Fault Attacks