SWIPE: eager erasure of sensitive data in large scale systems software

ABSTRACT

We describe SWIPE, an approach to reduce the life time of sensitive, memory resident data in large scale applications written in C. In contrast to prior approaches that used a delayed or lazy approach to the problem of erasing sensitive data, SWIPE uses a novel eager erasure approach that minimizes the risk of accidental sensitive data leakage. SWIPE achieves this by transforming a legacy C program to include additional instructions that erase sensitive data immediately after its intended use. SWIPE is guided by a highly-scalable static analysis technique that precisely identifies the locations to introduce erase instructions in the original program. The programs transformed using SWIPE enjoy several additional benefits: minimization of leaks that arise due to data dependencies; erasure of sensitive data with minimal developer guidance; and negligible performance overheads.

References

1. Resouce Standard Metrics. http://msquaredtechnologies.com.
2. StackOverflow. http://stackoverflow.com/questions.
3. Aiken, A., Bugrara, S., Dillig, I., Dillig, T., Hackett, B., and Hawkins, P. An Overview of the Saturn Project. In Program Analysis for Software Tools and Engineering (San Diego, CA, 2007).
4. Akritidis, P. Cling: A Memory Allocator to Mitigate Dangling Pointers. In USENIX Security Symposium (Washington, DC, 2010).
5. Andersenm, L. O. Program Analysis and Specialization for the C Programming Language. Tech. rep., 1994.
6. Austin, T. M., Breach, S. E., and Sohi, G. S. Efficient Detection of All Pointer and Array Access Errors. In Programming Language Design and Implementation (Orlando, FL, 1994).
7. Avots, D., Dalton, M., Livshits, V. B., and Lam, M. S. Improving Software Security with a C Pointer Analysis. In International conference on Software engineering (St. Louis, MO, 2005).
8. Boehm, H.-J. A Garbage Collector for C and C
9. . http://www.hpl.hp.com/personal/Hans\_Boehm/gc, 2002.
10. Broadwell, P., Harren, M., and Sastry, N. Scrash: A System for Generating Secure Crash Information. In USENIX Security Symposium (Washington, DC, 2003).
11. Cherem, S., and Rugina, R. Uniqueness Inference for Compile-time Object Deallocation. In International Symposium on Memory Management (Montreal, Quebec, Canada, 2007).
12. Chong, S., and Myers, A. C. Language-Based Information Erasure. In Computer Security Foundations Workshop (Aix-en-Provence, France, 2005).
13. Chong, S., and Myers, A. C. End-to-End Enforcement of Erasure and Declassification. In Computer Security Foundations Symposium (Pittsburgh, PA, 2008).
14. Chow, J., Pfaff, B., Garfinkel, T., Christopher, K., and Rosenblum, M. Understanding Data Lifetime via Whole System Simulation. In USENIX Security Symposium (San Diego, CA, 2004).
15. Chow, J., Pfaff, B., Garfinkel, T., and Rosenblum, M. Shredding Your Garbage: Reducing Data Lifetime through Secure Deallocation. In USENIX Security Symposium (Baltimore, MD, 2005).
16. Dor, N., Rodeh, M., and Sagiv, M. CSSV: Towards a Realistic Tool for Statically Detecting All Buffer Overflows in C. In Programming Language Design and Implementation (San Diego, CA, 2003).
17. Ganapathy, V., Jha, S., Chandler, D., Melski, D., and Vitek, D. Buffer Overrun Detection using Linear Programming and Static Analysis. In Computer and Communications Security (Washington D.C., 2003).
18. Gutmann, P. Secure Deletion of Data from Magnetic and Solid-state Memory. In USENIX Security Symposium (San Jose, California, 1996).
19. Gutmann, P. Data Remanence in Semiconductor Devices. In USENIX Security Symposium (Washington, DC, 2001).
20. Guttman, P. Software Leaves Encryption Keys, Passwords Lying around in Memory. Security Focus Vuln Dev Mailing List, 2002.
21. Guyer, S. Z., McKinley, K. S., and Frampton, D. Free-Me: A Static Analysis for Automatic Individual Object Reclamation. In Programming Language Design and Implementation (Ottawa, Ontario, Canada, 2006).
22. Halderman, J. A., Schoen, S. D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J. A., Feldman, A. J., Appelbaum, J., and Felten, E. W. Lest We Remember: Cold Boot Attacks on Encryption Keys. In Usenix Security Symposium (San Jose, CA, 2008).
23. Jones, R. W. M., H J Kelly, P., and Most C, and Uncaught Errors. Backwards-compatible Bounds Checking for Arrays and Pointers in C Programs. In HP Labs Tech Report (1997).
24. Khatiwala, T., Swaminathan, R., and Venkatakrishnan, V. Data Sandboxing: A Technique for Enforcing Confidentiality Policies. In Annual Computer Security Applications Conference (Miami Beach, FL, 2006).
25. Krohn, M., Yip, A., Brodsky, M., Cliffer, N., Kaashoek, M. F., Kohler, E., and Morris, R. Information Flow Control for Standard OS Abstractions. In Symposium on Operating Systems Principles (Washington, WA, 2007).
26. Larochelle, D., and Evans, D. Statically Detecting Likely Buffer Overflow Vulnerabilities. In USENIX Security Symposium (Washington, D.C., 2001).
27. Lattner, C., and Adve, V. Automatic Pool Allocation: Improving Performance by Controlling Data Structure Layout in the Heap. In Programming Language Design and Implementation (Chicago, IL, 2005).
28. McCune, J. M., Li, Y., Qu, N., Zhou, Z., Datta, A., Gligor, V., and Perrig, A. TrustVisor: Efficient TCB Reduction and Attestation. In IEEE Symposium on Security and Privacy (Oakland, CA, 2010).
29. Necula, G. C., McPeak, S., Rahul, S. P., and Weimer, W. CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs. In Conference on Compiler Construction (Grenoble, France, 2002).
30. Necula, G. C., McPeak, S., and Weimer, W. CCured: Type-safe Retrofitting of Legacy Code. In Principles of Programming Languages (Portland, OR, 2002).
31. Nystrom, E. M., Kim, H.-S., and Hwu, W.-M. W. Bottom-Up and Top-Down Context-Sensitive Summary-Based Pointer Analysis. In Static Analysis Symposium (Verona, Italy, 2004).
32. Rugina, R., and Rinard, M. Symbolic Bounds Analysis of Pointers, Array Indices, and Accessed Memory Regions. In Programming Language Design and Implementation (Vancouver, British Columbia, Canada, 2000).
33. Sagiv, M., Reps, T., and Wilhelm, R. Parametric Shape Analysis via 3-valued Logic. In Principles of Programming Languages (San Antonio, TX, 1999).
34. Steensgaard, B. Points-to Analysis in Almost Linear Time. In Principles of Programming Languages (St. Petersburg Beach, FL, 1996).
35. Xie, Y., Chou, A., and Engler, D. ARCHER: Using Symbolic, Path-sensitive Analysis to Detect Memory Access Errors. In European Software Engineering Conference (Helsinki, Finland, 2003).
36. Zeldovich, N., Boyd-Wickizer, S., Kohler, E., and Mazières, D. Making Information Flow Explicit in HiStar. In Symposium on Operating Systems Design and Implementation (Seattle, WA, 2006).
37. Zheng, X., and Rugina, R. Demand-driven Alias Analysis for C. In Principles of Programming Languages (San Francisco, CA, 2008).

Index Terms

• General and reference

  • Cross-computing tools and techniques

    • Verification

• Security and privacy

  • Cryptography

    • Cryptanalysis and other attacks

  • Intrusion/anomaly detection and malware mitigation

  • Systems security

    • Operating systems security

• Social and professional topics

  • Computing / technology policy

    • Computer crime