Control Flow Integrity Enforcement with Dynamic Code Optimization

Lin, Yan; Tang, Xiaoxiao; Gao, Debin; Fu, Jianming

doi:10.1007/978-3-319-45871-7_22

Cited by 6 publications

(1 citation statement)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Further, DBT provides the facility of instruction-level instrumentation. This can be useful in many ways: inlining security monitors, sandboxing, fine-grained resource accounting, debugging, or deployment of third-party patches in response to newly discovered flaws (though these are not our focus) [12], [13], [25], [39], [44]. Contributions & Results.…”

Section: Introductionmentioning

confidence: 99%

Binary Compatibility For SGX Enclaves

Shinde,

Cui,

Sen

et al. 2020

Preprint

View full text Add to dashboard Cite

Enclaves, such as those enabled by Intel SGX, offer a powerful hardware isolation primitive for application partitioning. To become universally usable on future commodity OSes, enclave designs should offer compatibility with existing software. In this paper, we draw attention to 5 design decisions in SGX that create incompatibility with existing software. These represent concrete starting points, we hope, for improvements in future TEEs. Further, while many prior works have offered partial forms of compatibility, we present the first attempt to offer binary compatibility with existing software on SGX. We present RATEL, a system that enables a dynamic binary translation engine inside SGX enclaves on Linux. Through the lens of RATEL, we expose the fundamental trade-offs between performance and complete mediation on the OS-enclave interface, which are rooted in the aforementioned 5 SGX design restrictions. We report on an extensive evaluation of RATEL on over 200 programs, including micro-benchmarks and real applications such as Linux utilities.

show abstract

Section: Introductionmentioning

confidence: 99%