Secure Cache: Run-Time Detection and Prevention of Buffer Overflow Attacks

CD Proc. of the Asia and South Pacific International Conference on Embedded SoCs (ASPICES05), Jul. 2005.This paper shows a novel cache architecture, called SCache, to detect and prevent buffer-overflow attacks at run time. A number of malicious codes exploit buffer-overflow vulnerability to alter a return-address value and hijack the program-execution control. In order to solve the security issue, SCache generates replica cache lines on each return-address store, and compares the original value loaded from the memory stack with the replica one on the corresponding return-address load. The number and the placement policy of the replica line strongly affect both performance and vulnerability. In our evaluation, it has been observed that SCache can protect more than 99.3% of return-address loads from buffer-overflow attacks, while it causes negligible performance overhead