Programmable decoder and shadow threads: tolerate remote code injection exploits with diversified redundancy

摘要: We present a lightweight hardware framework for providing high assurance detection and prevention of code injection attacks using lockstep diversified shadow execution. Recent studies show that diversification can detect software by checking the consistency their behavior simultaneously. Unfortunately, severe performance degradation extra system costs caused these methods are unacceptable in many applications. This paper presents hardware-level, thread to enrich diversity execution, with facilitation from programmable decoder novel CPU support tightly coupled technique. Specifically, given piece (legacy) binary code, we first generate versions an offline rewriter translator at runtime. Two images launched as dual simultaneous threads layer one primary other thread. Instructions not executed but just compared, thus incur no OS side-effects. The extended is able decode instructions both threads, dispatch them next stage pipeline comparison. Any mismatch decoded two remotely injected will be detected. Our design provides instruction set randomization (ISR) minimal cost performance, when compared straight-forward ISR implementation. simulation results indicate our incurs very small overheads protection against attacks.