Preserving Runtime Control-Flow Integrity Transparently Through Hardware-Based Stack Confidentiality and Integrity on RISC-V IoT Devices

RISC-V devices are widely used in diverse IoT applications, where security is critical. Control flow hijacking attacks can circumvent existing security mechanisms to transfer the program control flow to harmful gadget chains arranged by adversaries, which are primarily initiated by tampering with the data frame and return address within the stack. In this work, we present a microarchitecture-level, hardware-assisted, lightweight scheme for encrypting and verifying stack integrity, thereby transparently enforcing runtime control-flow integrity (CFI). The encrypted stack hinders attackers' analysis and increases the difficulty of assembling malicious gadgets. Stack integrity verification enables the system to detect malicious actions that tamper with return addresses and crucial registers at runtime. We implement the system on an Xilinx XC7K325T FPGA with the T-head Xuantie E906 RISC-V core. The experimental results show that, with a 16-kB D-Cache across the ten selected benchmark sets, this work incurs an average performance overhead of 4.89%. At the same time, the CoreMark score decreases by merely 0.10%. The area introduced by the proposed hardware is 10.01% of the total system-on-chip (SoC) under SAED 32-nm technology.