1. RollSec: Automatically Secure Software States Against General Rollback
- Author
-
Weiqi Dai, Hai Jin, Weizhong Qiang, Shouhuai Xu, Zhongze Liu, Deqing Zou, and Du Yukun
- Subjects
010302 applied physics ,Correctness ,Compensating transaction ,business.industry ,Computer science ,media_common.quotation_subject ,Overhead (engineering) ,020207 software engineering ,Crash ,02 engineering and technology ,Computer security ,computer.software_genre ,01 natural sciences ,Theoretical Computer Science ,Software ,Debugging ,0103 physical sciences ,0202 electrical engineering, electronic engineering, information engineering ,State (computer science) ,business ,computer ,Rollback ,Information Systems ,media_common - Abstract
The rollback mechanism is critical in crash recovery and debugging, but its security problems have not been adequately addressed. This is justified by the fact that existing solutions always require modifications on target software or only work for specific scenarios. As a consequence, rollback is either neglected or restricted or prohibited in existing systems. In this paper, we systematically characterize security threats of rollback as abnormal states of non-deterministic variables and resumed program points caused by rollback. Based on this, we propose RollSec (for Rollback Security), which provides general measurements including state extracting, recording, and compensating, to maintain correctness of these abnormal states for eliminating rollback threats. RollSec can automatically extract these states based on language-independent information of software as protection targets, which will be monitored during run-time, and compensated to correct states on each rollback without requiring extra modifications or supports of specific architectures. At last, we implement a prototype of RollSec to verify its effectiveness, and conduct performance evaluations which demonstrate that only acceptable overhead is introduced.
- Published
- 2017