CFI CaRE: Hardware-Supported Call and Return Enforcement for Commercial Microcontrollers

摘要: With the increasing scale of deployment Internet Things (IoT), concerns about IoT security have become more urgent. In particular, memory corruption attacks play a predominant role as they allow remote compromise devices. Control-flow integrity (CFI) is promising and generic defense technique against these attacks. However, given nature deployments, existing protection mechanisms for traditional computing environments (including CFI) need to be adapted setting. this paper, we describe challenges enabling CFI on microcontroller (MCU) based We then present CaRE, first interrupt-aware scheme low-end MCUs. CaRE uses novel way protecting metadata by leveraging TrustZone-M extensions introduced in ARMv8-M architecture. Its binary instrumentation approach preserves layout target MCU software, allowing pre-built bare-metal code protected CaRE. our implementation Cortex-M Prototyping System demonstrate that secure while imposing acceptable performance impact.