RetTag: Hardware-Assisted Return Address Integrity on RISC-V

Wang，Yu1; Wu，Jinting1; Yue，Tai1,2; Ning，Zhenyu1; Zhang，Fengwei1

10.1145/3517208.3523758

2022-04-05

15th European Workshop on Systems Security (EuroSec)

EuroSec 2022 - Proceedings of the 15th European Workshop on Systems Security

50-56

APR 05-08, 2022

null,Rennes,FRANCE

1601 Broadway, 10th Floor, NEW YORK, NY, UNITED STATES

ASSOC COMPUTING MACHINERY

Memory-corruption-based return address hijacking, such as Return-oriented Programming (ROP), is a prevalent attack technique that compromises the program's control flow integrity. So far, software-based defenses against these attacks either introduce heavy performance overhead or trade-off security for performance. Meanwhile, some hardware-Assisted defense mechanisms are not practical for large-scale deployment due to additional requirements of hardware features and flaws caused by complicated design. In this paper, we present RetTag, a hardware-Assisted and crypto-based defense scheme on RISC-V architecture that leverages Pointer Authentication Code (PAC) embedded into the unused bits of function return address to ensure return address integrity. We extend RISC-V ISA with Return Address Authentication (RAA) instructions to generate the PAC efficiently. We integrate RetTag into the mainstream compilers GCC and LLVM to help developers transparently employ the defense and implement a prototype of RetTag on the Rocket emulator and FPGA development board to demonstrate its effectiveness by detecting various ROP attacks. Moreover, the performance evaluation shows that RetTag only introduces 0.11% performance overhead on NBench and 7.69% on Coremark.

pointer authentication code return address integrity RISC-V

第一 ; 通讯

英语

EI ; CPCI-S

National Natural Science Foundation of China["62102175","62002151"]

Computer Science

Computer Science, Information Systems ; Computer Science, Theory & Methods

WOS:000927582300008

20221611992648

Codes (symbols) ; Computer hardware ; Economic and social effects ; Hardware security ; Network security ; Rockets

Rockets and Missiles:654.1 ; Computer Systems and Equipment:722 ; Computer Software, Data Handling and Applications:723 ; Data Processing and Image Processing:723.2 ; Social Sciences:971

2-s2.0-85128423428

Scopus

1.Research Institute of Trustworthy Autonomous Systems and Compass Lab,Southern University of Science and Technology,China
2.College of Computer Science and Technology,National University of Defense Technology,China

Wang，Yu,Wu，Jinting,Yue，Tai,et al. RetTag: Hardware-Assisted Return Address Integrity on RISC-V[C]. 1601 Broadway, 10th Floor, NEW YORK, NY, UNITED STATES:ASSOC COMPUTING MACHINERY,2022:50-56.