Buddy Stacks: Protecting Return Addresses with Efficient Thread-Local Storage and Runtime Re-Randomization

ABSTRACTBuffer overflow attacks are caused due to exploitation of stack or heap in computer memory. One of the targets behind buffer overflow attacks is the return address of a function. Another potential actor in buffer overflow attacks is Global Offset Table (GOT); exploiting it can also lead to disastrous results, such as a call to printf(), which can be transformed to a system() call. This paper focuses on mitigation of stack-based buffer overflow attacks and securing GOT. The proposed approach is a compiler-level protection aimed at preventing such exploits using shadow stacks, a linked list behaving as a stack, that stores the return addresses and frame pointers. The return address and frame pointer are pushed into these stacks during the prologue of every function, and in the epilogue it is compared with the one residing inside actual stack. If they match, the program continues; otherwise, it is terminated and this event is recorded into the system log. To make these shadow stacks invisible from the attacker, the address of the top of shadow stack is stored inside Thread Local Storage (TLS) for the process to refer it later. In order to forestall GOT manipulation, the proposed approach uses a global array which contains the backup of GOT; when a call to GOT entry is made, the value inside that entry and the respective value inside the backup table are compared. If they match, the program continues; otherwise, it terminates the process instantaneously. The proposed approach, Secure Patrol, is efficient, secure against stack-based buffer overflow and resistant to GOT manipulation.

Return-Oriented Programming (ROP) attacks pose a significant threat to the control-flow integrity of Internet of Things (IoT) devices, which operate in resource-constrained environments with limited memory isolation and runtime protection. Existing defenses, such as shadow stacks and message authentication code (MAC)-based schemes, face key limitations in IoT: shadow stacks depend on trusted hardware often absent in lightweight devices, while message authentication code (MAC) schemes lack semantic binding to the call path, making them vulnerable to replay attacks during recursion or stack reuse. To address these challenges, this paper proposes TRACE, a lightweight return-path authentication mechanism with path-semantic awareness, designed for IoT devices. TRACE dynamically encodes the function call context into an evolving path-state vector, which is then combined with the return address and cryptographically processed to generate a semantically unique authentication tag. At each function return, TRACE reconstructs the path state and verifies the tag to enforce precise runtime control-flow integrity. We evaluate TRACE in both synthetic and real-world attack scenarios. With the RIPE test suite, we demonstrate its robustness across five representative attack dimensions. Additionally, we identify a stack overflow vulnerability in the widely used libmodbus v2.9.3 protocol stack, construct a complete attack chain in a realistic IoT context, and validate TRACE’s effectiveness in mitigating such attacks. Experimental results show that TRACE reliably detects return-path tampering even without Address Space Layout Randomization (ASLR) or stack protections and incurs only a 5.3% runtime overhead, offering strong security with lightweight performance suitable for resource-constrained IoT deployments.

Container terminal performance is largely determined by its design decisions, which include the number and type of quay cranes, stack cranes, transport vehicles, vehicle travel path and stack layout. We investigate the orientation of the stack layout (parallel or perpendicular to the quayside) on the throughput time performance of the terminals. Previous studies in this area typically use deterministic optimisation, and a few studies use probabilistic travel times and simulation to analyse the effect of stack layout on terminal throughput times. In this research, we capture the stochasticity with an integrated queuing network modelling approach to analyse the performance of container terminals with parallel stack layout using automated lifting vehicles. Using this analytical model, we investigate 1008 parallel stack layout configurations on throughput times and determine the optimal stack layout configuration. We find that, assuming an identical width of the internal transport area, container terminals with parallel stack layout perform better (from 4–12% in terms of container throughput times) than terminals with a perpendicular stack layout.

In this poster, we present our experience developing JAVA applets and applications to create a client/server system on the world wide web, and show how the product is used in upper-division computer science classes.The set of programs consist of a client and a server. The client program in the prototype is a JAVA applet that is downloaded into the client machine and is executed in a user's web browser using the local memory, CPU and other resources. The server program in the prototype is a JAVA application that runs on a web server all the time. The client and the server programs use the socket interface [ Comer&Stevens 96] as the communication protocol, and are able to transmit data back and forth successfully over the internet. Figure 1 illustrates how the client and the server communicate over the socket interface.With the set of programs in place, students in the upper-division computer science classes, including software engineering, databases systems, and distributed application development, are able to build their own software for the course projects, on top of the software prototypes.Revision of a given set of JAVA programs proves to be a better approach in learning client/server programming using JAVA and sockets, compared to requiring students to create JAVA programs from the scratch.

Control-flow integrity (CFI) plays a very important role in defending against code reuse attacks by protecting the control flows of programs from being hijacked. However, previous CFI methods suffer from performance overheads, cost, or security issues. In this paper, we propose a new CFI based on a lightweight encryption architecture with advanced encryption standard (LEA-AES) to address the challenges above. The LEA exploits AES to encrypt and decrypt return addresses and instructions at indirect jump destinations, which protects function calls and indirect jumps from being reused by return-oriented programming (ROP) and jump-oriented programming (JOP) attacks. For ROP, the encryption and decryption of return addresses are performed when the call and ret instructions are executing; for JOP, the encryption of instructions are performed when programs are loading into memory and the decryption of instructions are performed right before they are executing. The LEA-AES does not need to revise instruction sets of CPU and its security is also guaranteed by the encryption mechanism in addition to its high performance. Experimental results showed that the run-time and loading time overheads of LEA-AES are both less than 4% and the memory overhead is 0.62%.

With a wide spread of malicious software attacks, run-time stack has been drawing attention because it is one of the most vulnerable points in computer architecture. Conventional stack layout, in which local variables for user input and control flow data such as return address are saved close to each other, is often the root of the attack vulnerability. This paper proposes a simple finite state machine to track usage of stack frame locations at a fine granularity of 2–bytes. Such a fine grain protection is necessary to distinguish adjacent stack frame locations, which allows detecting abnormal memory operations even in real mode running of a boot loader. The proposed scheme guarantees 2–byte granularity for preventing malicious writes in the stack using small additional memory space for the finite state machine.

The development of an efficient checkpointing facility exploiting operating systems services of the GENESIS cluster operating system

High-performance Web servers are essential to meet the growing demands of the Internet and large-scale intranets. Satisfying these demands requires a thorough understanding of key factors affecting Web server performance. This paper presents empirical analysis illustrating how dynamic and static adaptivity can enhance Web server performance. Two research contributions support this conclusion. First, the paper presents results from a comprehensive empirical study of Web servers (such as Apache, Netscape Enterprise, PHTTPD, Zeus, and JAWS) over high-speed ATM networks. This study illustrates their relative performance and precisely pinpoints the server design choices that cause performance bottlenecks. Once network and disk I/O overheads are reduced to negligible constant factors, the main determinants of Web server performance are its protocol processing path and concurrency strategy. Moreover no single strategy performs optimally for all load conditions and traffic types. Second, we describe the design techniques and optimizations used to develop JAWS, our high-performance adaptive Web server. JAWS is an object-oriented Web server that was explicitly designed to alleviate the performance bottlenecks we identified in existing Web servers. The performance optimizations used in JAWS include adaptive prespawned threading, fixed headers, cached date processing, and file caching. In addition, JAWS uses a novel software architecture that substantially improves its portability and flexibility, relative to other Web servers.

The subject of this paper is "active" or "dynamic" web forms handled by Dyalog APL running on a web server. With "active" web forms, the HTML which specifies form controls is generated dynamically by a server program, in contrast to "static" web forms in which the HTML is fixed and does not vary from one page hit to the next. Also, I will be discussing only "thin client" approaches which minimize the amount of code which runs on the client machine. The method shown, which I call a "standard template" method, allows source pages to be maintained with visual tools such as Macromedia Dreamweaver and minimizes the amount of coding required when new forms are created in the same general format.

At present, the log module of high-speed rail dispatching system has poor compatibility and high development difficulty due to its component embedding mode; in addition, network quality and security reinforcement seriously affect its performance. With Web Service technology, the loosely coupled and heterogeneous log module architecture is designed and implemented to solve the above problems. It takes task distribution and implementation as the core and provides 3 services: log access service, log query service and log statistics mining service. 1) A large number of cluster service providers makes full use of computing resources, storage resources and network resources to provide services externally; 2) the simplify centralized management service requestor receives unified registration services remotely; 3) the application of log compression method, AOP theory and the complete data flow management scheme further improves module capability. Simulation experiments verify the effectiveness of system optimization.

With the growing number of web services, there arise issues of finding relevant services. But, a web service is typically published by registering its WSDL file and a brief description in UDDI business registries. This limits the search mechanism for web services to keyword based searches. In order to overcome shortcomings of keyword based search, there are several attempts to use clustering or ontology for web services search. However, many weaknesses are remained in these approaches. In this paper, we propose a semantic search engine of web services that can improve the recall and the precision using both the clustering approach and the ontology approach. To this purpose, The experimental results show that our system has higher performances both in the rate of recall and precision compared to the existing method.

New value-added business, generated by Web service composition in BPEL, provides more powerful and flexible features. SOAP-based web services invoked in BPEL are heavy with redundant information and lower performance. RESTful Web service is brought forward to new value-added business as an alternative solution. However, it's a big challenge to compose RESTful Web services with SOAP-based Web Services in SOA BPEL business processes. BPEL is not designed to use RESTful Web services because these types of services do not use WSDL to describe themselves. This paper proposes a novel approach for integrating RESTful Web services and SOAP-based Web services in business processes described in BPEL. The approach is applied to a practical multimedia conference BPEL process, and the experimental data show the stability of the new RESTful BPEL process with a higher performance.

This paper describes the design and implementation of a high performance terminal communication program for a GPS-based vehicle-tracing mobile prototyping platform (GPSVTMPP). First we introduce the architecture and function of our mobile platform and analyze some bottlenecks. Then, we present detailed strategies and methods for how to use Microsoft's I/O Completion Port(IOCP) model to implement the Winsock 2 communication server program. We prove that this server program can improve the efficiency, flexibility and robustness of the single communication server, especially for large-scale communication. Finally, this paper summarizes the results of some application experiments and other results using this platform.

Advances in virtualization technology have focused mainly on strengthening the isolation barrier between virtual machines (VMs) that are co-resident within a single physical machine. At the same time, a large category of communication intensive distributed applications and software components exist, such as web services, high performance grid applications, transaction processing, and graphics rendering, that often wish to communicate across this isolation barrier with other endpoints on co-resident VMs. State of the art inter-VM communication mechanisms do not adequately address the requirements of such applications. TCP/UDP based network communication tends to perform poorly when used between co-resident VMs, but has the advantage of being transparent to user applications. Other solutions exploit inter-domain shared memory mechanisms to improve communication latency and bandwidth, but require applications or user libraries to be rewritten against customized APIs - something not practical for a large majority of distributed applications. In this paper, we present the design and implementation of a fully transparent and high performance inter-VM network loopback channel, called XenLoop, in the Xen virtual machine environment. XenLoop does not sacrifice user-level transparency and yet achieves high communication performance between co-resident guest VMs. XenLoop intercepts outgoing network packets beneath the network layer and shepherds the packets destined to co-resident VMs through a high-speed inter-VM shared memory channel that bypasses the virtualized network interface. Guest VMs using XenLoop can migrate transparently across machines without disrupting ongoing network communications, and seamlessly switch between the standard network path and the XenLoop channel. In our evaluation using a number of unmodified benchmarks, we observe that XenLoop can reduce the inter-VM round trip latency by up to a factor of 5 and increase bandwidth by a up to a factor of 6.

Automatic web services composition approaches aim at automatically composing services to satisfy users' request according to the information of users' input. As the number of web services is increasing, the performance of automatic service composition is faced with challenges. In this paper, we propose an approach based on backward chaining method to compose web services with high performance and good Qos, called Clustering Based Backward Chaining Method (CBBCM). We use k-means method to cluster services as the preliminary work. Services are clustered according to the semantic similarities of their output parameters. Skyline is used as an optimization to set services with good Qos on the top of each cluster. Then the adapted backward chaining method is applied to compose services. We evaluate our approach and the backward chaining method through experiment with different datasets. It is proved that our algorithm has a high performance and gets the composition results with better Qos.