Name
Abstract | ||
|---|---|---|
Protecting confidential data against memory disclosure attacks is crucial to many critical applications, especially those involve cryptographic operations. However, it is neither easy to identify involved cryptographic confidential data in a program nor to implement a fine-grained and yet efficient protection. Existing defensive techniques face many shortcomings such as coarse-grained protection or exorbitant overhead. As a result, real world crypto applications seldom applied this kind of protection in practice.To make the protection of cryptographic confidential data practical, we design and implement CRYPTOMPK, a source code analysis and transformation system to implement a domain-based memory isolation. CRYPTOMPK first automatically tracks and labels all sensitive memory buffers and operations in source code with a context-sensitive, crypto-aware information flow analysis. Then it partitions the source code into crypto and non-crypto domains with a context-dependent privilege switch instrumentation. By further utilizing Intel Memory Protection Keys (MPK), CRYPTOMPK generates executables with efficient domain switching, protecting them against typical memory disclosure vulnerabilities such as arbitrary memory read. In particular, by using CRYPTOMPK, a large number of intermediate memory buffers that have been previously ignored before are well protected, and thus the security risks are reduced significantly. We leveraged CRYPTOMPK to protect prevalent applications such as Apache and Nginx with widely used crypto libraries (e.g., OpenSSL, LibSodium). CRYPTOMPK only needs several minutes to analyze each of these complex cryptographic programs and incurs at most 9.53% performance overhead for the protected programs. |
Year | DOI | Venue |
|---|---|---|
2022 | 10.1109/SP46214.2022.9833650 | 2022 IEEE Symposium on Security and Privacy (SP) |
Keywords | DocType | ISSN |
memory disclosure attacks,cryptographic operations,crypto applications,source code analysis,domain-based memory isolation,context-dependent privilege switch instrumentation,Intel Memory Protection Keys,domain switching,memory disclosure vulnerability,intermediate memory buffers,crypto libraries,complex cryptographic programs,CRYPTOMPK,context-sensitive crypto-aware information flow analysis,sensitive memory buffer tracking,cryptographic secret protection,cryptographic confidential data protection,source code transformation system,Intel MPK,arbitrary memory read,security risk reduction,Apache,Nginx,OpenSSL,LibSodium | Conference | 1081-6011 |
ISBN | Citations | PageRank |
978-1-6654-1317-6 | 0 | 0.34 |
References | Authors | |
19 | 9 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Xuancheng Jin | 1 | 0 | 0.34 |
| Xuangan Xiao | 2 | 0 | 0.34 |
| Songlin Jia | 3 | 0 | 0.34 |
| Wang Gao | 4 | 0 | 0.34 |
| Dawu Gu | 5 | 644 | 103.50 |
| Hang Zhang | 6 | 0 | 0.34 |
| Siqi Ma | 7 | 0 | 1.69 |
| Zhiyun Qian | 8 | 1113 | 74.48 |
| Juanru Li | 9 | 179 | 24.07 |