Innovative Software Security Technology

Among various ways of cyber security, protection of software becomes a key issue in cyber security as the deployments of embedded software systems such as in IoT (Internet of Things) Devices, Drones, and Autonomous Vehicles are increasing exponentially. Software vulnerabilities exist in all types of software. A well known software vulnerability is the buffer overflow. The buffer overflow occurs when a software program attempts to write data into a memory buffer beyond its boundary. Attackers exploit buffer overflow to intercept control-flow of software programs or disclose information critical to security. In particular, attackers employ buffer overflow to overwrite a pointer, i.e. a memory location that contains an address of an instruction which the processor will jump to and execute during program execution. For information leak, attackers overwrite a specific memory location checking if crash occurs. If not, the written bits are what are at the location.

Patent pending Zeus technology performs the dynamic re-encryption of code pointers to protect software programs written in C/C++ programming language from buffer overflow attacks for interception and disclosure of control-flow. Zeus injects code fragments into programs at compile time so that the programs harden themselves by encryption and re-encryption at runtime. Zeus has low overhead in execution time and does not require any additional security features outside of the program. Since Zeus can cover zero-day attacks, Zeus dramatically reduces the risks caused by buffer overflow. Zeus can be implemented into C/C++ Compliers.