Portal de Periódicos da CAPES

RIO: Return Instruction Obfuscation for Bare-Metal IoT Devices

2023; Institute of Electrical and Electronics Engineers; Volume: 11; Linguagem: Inglês

10.1109/access.2023.3293862

2169-3536

Beomseok Kim, Kiyoung Lee, Woojin Park, Jinsung Cho, Ben Lee,

Physical Unclonable Functions (PUFs) and Hardware Security

The proliferation of IoT comes with many challenges, among which security is one of the most serious issues. Since most IoT devices are designed based on bare-metal devices with low performance, low power, and small form factor, an attacker can easily perform firmware extraction and analysis. In addition, code reuse attacks, such as Return Oriented Programming (ROP) attacks, are possible based on the analyzed firmware information. Since most code reuse attacks are performed through a combination of gadgets that include return instructions, preventing an attacker from analyzing return instructions can be a fundamental solution for these attacks. To prevent code reuse attacks on bare-metal based IoT devices, this paper proposes Return Instruction Obfuscation (RIO). The proposed scheme encrypts all return instructions in the firmware and instruments the modules necessary to decrypt and execute the encrypted return instructions using a Low Level Virtual Machine (LLVM). Since all return instructions in the firmware are encrypted, the proposed scheme can prevent attackers from performing firmware analysis and gadget collection. The proposed scheme was implemented and evaluated on Nuvoton's NuMaker-PFM-M2351 development board with an ARM Cortex-M23 based SoC.