• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.9 no.6
• /
• pp.1333-1340
• /
• 2005

This paper is based on the study to reduce a system panic state. A panic state could be caused by a programmer or an administrator's careless mistake. The proposed hardening Operating System of this paper stops the process which is running in the kernel with an error. The error process for the value type and the address type of a certain variable have to be restored. Installed with kernel hardening, Operating System checks the recovery possibility of the process first and then restores the process which can be recovered. When it is possible to recover the kernel code with an error, it is to be recovered in ASSERT() function.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.5
• /
• pp.961-969
• /
• 2004

A panic state is often caused by careless computer control. It could be also caused by a kernel programmer's mistake. It can make a big problem in computer system when it happens a lot. When a panic occurs, the process of the panic state has to be checked, then if it can be restored, operating system restores it, but if not, operating system runs the panic function to stop the system in the kernel hardening O.S. To decide recovery of the process, the type of the panic for the present process should be checked. 1'he value type and the address type have to restore the process. If the system process is in a panic state, the system should be designed to shutdown hardening function In the Linux operating system. So it has to decide whether the process should be restored or not before going to the panic state.

• Journal of KIISE:Computer Systems and Theory
• /
• v.33 no.3
• /
• pp.178-192
• /
• 2006

The buffer overflow attack is the single most dominant and lethal form of security exploits as evidenced by recent worm outbreaks such as Code Red and SQL Stammer. In this paper, we propose microarchitectural techniques that can detect and recover from such malicious code attacks. The idea is that the buffer overflow attacks usually exhibit abnormal behaviors in the system. This kind of unusual signs can be easily detected by checking the safety of memory references at runtime, avoiding the potential data or control corruptions made by such attacks. Both the hardware cost and the performance penalty of enforcing the safety guards are negligible. In addition, we propose a more aggressive technique called corruption recovery buffer (CRB), which can further increase the level of security. Combined with the safety guards, the CRB can be used to save suspicious writes made by an attack and can restore the original architecture state before the attack. By performing detailed execution-driven simulations on the programs selected from SPEC CPU2000 benchmark, we evaluate the effectiveness of the proposed microarchitectural techniques. Experimental data shows that enforcing a single safety guard can reduce the number of system failures substantially by protecting the stack against return address corruptions made by the attacks. Furthermore, a small 1KB CRB can nullify additional data corruptions made by stack smashing attacks with only less than 2% performance penalty.