NDLI: Transparent runtime randomization for security

Content Provider	IEEE Xplore Digital Library
Author	Jun Xu Kalbarczyk, Z. Iyer, R.K.
Copyright Year	2003
Description	Author affiliation: Center for Reliable & High-Performance Comput., Univ. of Illinois, Urbana, IL, USA (Jun Xu; Kalbarczyk, Z.; Iyer, R.K.)
Abstract	A large class of security attacks exploit software implementation vulnerabilities such as unchecked buffers. This paper proposes transparent runtime randomization (TRR), a generalized approach for protecting against a wide range of security attacks. TRR dynamically and randomly relocates a program's stack, heap, shared libraries, and parts of its runtime control data structures inside the application memory address space. Making a program's memory layout different each time it runs foils the attacker's assumptions about the memory layout of the vulnerable program and makes the determination of critical address values difficult if not impossible. TRR is implemented by changing the Linux dynamic program loader, hence it is transparent to applications. We demonstrate that TRR is effective in defeating real security attacks, including malloc-based heap overflow, integer overflow, and double-free attacks, for which effective prevention mechanisms are yet to emerge. Furthermore, TRR incurs less than 9% program startup overhead and no runtime overhead.
Sponsorship	IEEE Comput. Soc. Tech. Committee on Distrib. Process. IEEE Comput. Soc. Tech. Committee on Fault-Tolerant Comput. IFIP WG 10.4 on Dependable Comput. & Fault Tolerance Italian Res. Council - ISTI Univ. Florence
Starting Page	260
Ending Page	269
File Size	386792
Page Count	10
File Format	PDF
ISBN	0769519555
ISSN	10609857
DOI	10.1109/RELDIS.2003.1238076
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2003-10-06
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Runtime Data security Information security Operating systems Buffer overflow Linux Invasive software Computer bugs Computer crime Protection
Content Type	Text
Resource Type	Article
Subject	Hardware and Architecture Computer Networks and Communications Theoretical Computer Science Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Libarray of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

SegmentShield: Exploiting Segmentation Hardware for Protecting against Buffer Overflow Attacks

Secure Bit: Transparent, Hardware Buffer-Overflow Protection

Detecting heap smashing attacks through fault containment wrappers

Secure Bit Enhanced Canary: Hardware Enhanced Buffer-Overflow Protection

Libsafe: transparent system-wide protection against buffer overflow attacks

Efficient array & pointer bound checking against buffer overflow attacks via hardware/software

A processor architecture defense against buffer overflow attacks

On the General Applicability of Instruction-Set Randomization

Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software

Transparent runtime randomization for security

Similar Documents

SegmentShield: Exploiting Segmentation Hardware for Protecting against Buffer Overflow Attacks

Secure Bit: Transparent, Hardware Buffer-Overflow Protection

Detecting heap smashing attacks through fault containment wrappers

Secure Bit Enhanced Canary: Hardware Enhanced Buffer-Overflow Protection

Libsafe: transparent system-wide protection against buffer overflow attacks

Efficient array & pointer bound checking against buffer overflow attacks via hardware/software

A processor architecture defense against buffer overflow attacks

On the General Applicability of Instruction-Set Randomization

Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software

Transparent runtime randomization for security