Binary Rewritten based Control Flow Integrity Protection for Wireless Industrial Communication System

Industrial communication system (ICS) is widely used in critical infrastructure. As the scale of ICS increases, more and more devices are equipped with wireless capabilities which widen the scope of attack vectors. Therefore, its security has draw significant attention in recent years. As a key component of ICS, the security of Programmable Logic Controller (PLC) is directly related to ICS security. However, due to PLC's special mechanism, as long as the attack successfully break into the PLC, conventional control flow integrity (CFI) mechanism can't effectively protect its control flow. To address this problem, we propose a novel CFI mechanism to enhance the security of PLC. First, we design an instrumentation framework, with which we can add custom features such as CFI to enhance the PLC. Second, to effectively protect the control flow, we design a CFI mechanism based on sensitive memory protection using hash check. Last, to ensure the instrumented binary can be correctly loaded and match the constraint of runtime, we design a control binary reconstruction method. To evaluate the correctnessof our CFI mechanism, we perform experiments in two different PLCs using 15 different control binaries. The result shows that our CFI mechanism can successfully protect PLC's control flow. Besides, according to our evaluation, the size of the generated control binary instrumented with CFI mechanism code merely grow a little compared with its original size. As for the dynamically cost, our instrumented code does influence the count of the instructions non-ignorable but is within the acceptable range.