2017/11/30 by Ajay Brahmakshatriya, Brahmakshatriya, Ajay, Piyus Kedia +12
Computer Science · #Advanced Malware Detection Techniques #FOS: Computer and information sciences #Network Security and Intrusion Detection #Programming Languages (cs.PL) #Security and Verification in Computing #cs.PL
paper · pdf · doi:10.48550/arxiv.1711.11396
Technical report for CONFLLVM: A Compiler for Enforcing Data Confidentiality in Low-Level Code, appearing at EuroSys 2019
openalex publication_date 2017/11/30 · arxiv created 2019/03/13 · arxiv updated 2019/03/15 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
We present an instrumenting compiler for enforcing data confidentiality in low-level applications (e.g. those written in C) in the presence of an active adversary. In our approach, the programmer marks secret data by writing lightweight annotations on top-level definitions in the source code. The compiler then uses a static flow analysis coupled with efficient runtime instrumentation, a custom memory layout, and custom control-flow integrity checks to prevent data leaks even in the presence of low-level attacks. We have implemented our scheme as part of the LLVM compiler. We evaluate it on the SPEC micro-benchmarks for performance, and on larger, real-world applications (including OpenLDAP, which is around 300KLoC) for programmer overhead required to restructure the application when protecting the sensitive data such as passwords. We find that performance overheads introduced by our instrumentation are moderate (average 12% on SPEC), and the programmer effort to port OpenLDAP is only about 160 LoC.