嵌入式系统抗缓冲区溢出攻击的硬件防御机制研究  

Study of a Hardware Defense Mechanism to Against Buffer Overflow Attacks for Embedded Systems

作　　者：万毓西[1] 刘政林[1] 霍文捷[1] 邹雪城[1] 

机构地区：[1]华中科技大学电子科学与技术系,湖北武汉430074

出　　处：《微电子学与计算机》2011年第4期135-139,共5页Microelectronics & Computer

基　　金：国家自然科学基金项目(60973034);2007新世纪优秀人才支持计划资助(NCET-07-0328);中央高校基本科研业务费资助(2010ZD033)

摘　　要：嵌入式系统设计时由于成本和功耗等方面的考虑而较少重视安全性,而一般采用的软件防御方式无法满足嵌入式系统在实时性和可靠性上的要求,缓冲区溢出作为最常见的软件安全漏洞对嵌入式系统安全构成严重威胁.文中构建了一种基于细粒度指令流监控(FIFM)的硬件防御机制,通过虚拟执行单元虚拟执行程序,在攻击发生之前检测攻击行为.实验结果表明FIFM能很好的防御典型的缓冲区溢出攻击,而且FIFM不需要修改程序,不破坏流水线完整性,对系统的性能影响小,本文的防护机制可以应用于其他嵌入式系统设计中以动态防御缓冲区溢出攻击.The embedded systems design pay less attention to safety out of consideration for cost and power con- sumption, and the software defense mechanism unable to achieve the requirement of the embedded systems in real- time and reliability, as the most common software vulnerabilities , buffer overflow poses a serious threat to embedded systems in safety. So we build a hardware defense mechanism based on fine granularity instruction flow monitor to against buffer overflow attacks, through virtual implement the procedures by ours virtual execution units, we can de- tect attacks before it come comply. The result shows that the hardware defense mechanism can defense these attacks completely, and neither change the source code or destroy the pipeline integrity, nor affects performance, our protec- tion mechanism could be used to prevent run-time buffer overflow attacks in other embedded systems.

关 键 词：缓冲区溢出攻击 虚拟执行单元 硬件防御 

分 类 号：TN4[电子电信—微电子学与固体电子学]