Secure Execution via Program Shepherding

TLDR

The paper introduces program shepherding, a method that monitors control‑flow transfers during execution to enforce a security policy. Program shepherding implements three techniques—restricting execution privileges by code origin, limiting control transfers by instruction class, source, and target, and guaranteeing that sandbox checks cannot be bypassed—to enforce security policies. The implementation demonstrates that program shepherding can prevent malicious code execution, incurs minimal performance overhead, and runs on unmodified native binaries on IA‑32 Linux and Windows without special hardware or OS support.

Abstract

We introduce program shepherding, a method for monitoring control flow transfers during program execution to enforce a security policy. Program shepherding provides three techniques as building blocks for security policies. First, shepherding can restrict execution privileges on the basis of code origins. This distinction can ensure that malicious code masquerading as data is never executed, thwarting a large class of security attacks. Second, shepherding can restrict control transfers based on instruction class, source, and target. For example, shepherding can forbid execution of shared library code except through declared entry points, and can ensure that a return instruction only targets the instruction after a call. Finally, shepherding guarantees that sandboxing checks placed around any type of program operation will never be bypassed. We have implemented these capabilities efficiently in a runtime system with minimal or no performance penalties. This system operates on unmodified native binaries, requires no special hardware or operating system support, and runs on existing IA-32 machines under both Linux and Windows.