CONFLLVM: A Compiler for Enforcing Data Confidentiality in Low-Level Code Article Swipe

PDF

Ajay Brahmakshatriya , Piyus Kedia , Derrick McKee , Pratik Bhatu , Deepak Garg , Akash Lal , Aseem Rastogi ·

YOU? · · 2017 · Open Access · · DOI: https://doi.org/10.48550/arxiv.1711.11396

We present an instrumenting compiler for enforcing data confidentiality in low-level applications (e.g. those written in C) in the presence of an active adversary. In our approach, the programmer marks secret data by writing lightweight annotations on top-level definitions in the source code. The compiler then uses a static flow analysis coupled with efficient runtime instrumentation, a custom memory layout, and custom control-flow integrity checks to prevent data leaks even in the presence of low-level attacks. We have implemented our scheme as part of the LLVM compiler. We evaluate it on the SPEC micro-benchmarks for performance, and on larger, real-world applications (including OpenLDAP, which is around 300KLoC) for programmer overhead required to restructure the application when protecting the sensitive data such as passwords. We find that performance overheads introduced by our instrumentation are moderate (average 12% on SPEC), and the programmer effort to port OpenLDAP is only about 160 LoC.

Related Topics

Concepts

Computer science Compiler Programmer Spec# Operating system Control flow Undo Instrumentation (computer programming) Programming language Overhead (engineering) Embedded system

Metadata

Type: preprint
Language: en
Landing Page: http://arxiv.org/abs/1711.11396
PDF: https://arxiv.org/pdf/1711.11396
OA Status: green
Cited By: 3
References: 39
Related Works: 10
OpenAlex ID: https://openalex.org/W2950796706

All OpenAlex metadata

Raw OpenAlex JSON

OpenAlex ID: https://openalex.org/W2950796706

Canonical identifier for this work in OpenAlex
DOI: https://doi.org/10.48550/arxiv.1711.11396

Digital Object Identifier
Title: CONFLLVM: A Compiler for Enforcing Data Confidentiality in Low-Level Code

Work title
Type: preprint

OpenAlex work type
Language: en

Primary language
Publication year: 2017

Year of publication
Publication date: 2017-11-30

Full publication date if available
Authors: Ajay Brahmakshatriya, Piyus Kedia, Derrick McKee, Pratik Bhatu, Deepak Garg, Akash Lal, Aseem Rastogi

List of authors in order
Landing page: https://arxiv.org/abs/1711.11396

Publisher landing page
PDF URL: https://arxiv.org/pdf/1711.11396

Direct link to full text PDF
Open access: Yes

Whether a free full text is available
OA status: green

Open access status per OpenAlex
OA URL: https://arxiv.org/pdf/1711.11396

Direct OA link when available
Concepts: Computer science, Compiler, Programmer, Spec#, Operating system, Control flow, Undo, Instrumentation (computer programming), Programming language, Overhead (engineering), Embedded system

Top concepts (fields/topics) attached by OpenAlex
Cited by: 3

Total citation count in OpenAlex
Citations by year (recent): 2025: 1, 2021: 1, 2020: 1

Per-year citation counts (last 5 years)
References (count): 39

Number of works referenced by this work
Related works (count): 10

Other works algorithmically related by OpenAlex

Full payload

id	https://openalex.org/W2950796706
doi	https://doi.org/10.48550/arxiv.1711.11396
ids.doi	https://doi.org/10.48550/arxiv.1711.11396
ids.mag	2950796706
ids.openalex	https://openalex.org/W2950796706
fwci
type	preprint
title	CONFLLVM: A Compiler for Enforcing Data Confidentiality in Low-Level Code
biblio.issue
biblio.volume
biblio.last_page
biblio.first_page
topics[0].id	https://openalex.org/T11424
topics[0].field.id	https://openalex.org/fields/17
topics[0].field.display_name	Computer Science
topics[0].score	1.0
topics[0].domain.id	https://openalex.org/domains/3
topics[0].domain.display_name	Physical Sciences
topics[0].subfield.id	https://openalex.org/subfields/1702
topics[0].subfield.display_name	Artificial Intelligence
topics[0].display_name	Security and Verification in Computing
topics[1].id	https://openalex.org/T11241
topics[1].field.id	https://openalex.org/fields/17
topics[1].field.display_name	Computer Science
topics[1].score	0.9986000061035156
topics[1].domain.id	https://openalex.org/domains/3
topics[1].domain.display_name	Physical Sciences
topics[1].subfield.id	https://openalex.org/subfields/1711
topics[1].subfield.display_name	Signal Processing
topics[1].display_name	Advanced Malware Detection Techniques
topics[2].id	https://openalex.org/T10400
topics[2].field.id	https://openalex.org/fields/17
topics[2].field.display_name	Computer Science
topics[2].score	0.9842000007629395
topics[2].domain.id	https://openalex.org/domains/3
topics[2].domain.display_name	Physical Sciences
topics[2].subfield.id	https://openalex.org/subfields/1705
topics[2].subfield.display_name	Computer Networks and Communications
topics[2].display_name	Network Security and Intrusion Detection
is_xpac	False
apc_list
apc_paid
concepts[0].id	https://openalex.org/C41008148
concepts[0].level	0
concepts[0].score	0.8527896404266357
concepts[0].wikidata	https://www.wikidata.org/wiki/Q21198
concepts[0].display_name	Computer science
concepts[1].id	https://openalex.org/C169590947
concepts[1].level	2
concepts[1].score	0.8084402680397034
concepts[1].wikidata	https://www.wikidata.org/wiki/Q47506
concepts[1].display_name	Compiler
concepts[2].id	https://openalex.org/C2778514511
concepts[2].level	2
concepts[2].score	0.7916744947433472
concepts[2].wikidata	https://www.wikidata.org/wiki/Q1374194
concepts[2].display_name	Programmer
concepts[3].id	https://openalex.org/C2778565505
concepts[3].level	2
concepts[3].score	0.6796383857727051
concepts[3].wikidata	https://www.wikidata.org/wiki/Q2207566
concepts[3].display_name	Spec#
concepts[4].id	https://openalex.org/C111919701
concepts[4].level	1
concepts[4].score	0.49877333641052246
concepts[4].wikidata	https://www.wikidata.org/wiki/Q9135
concepts[4].display_name	Operating system
concepts[5].id	https://openalex.org/C160191386
concepts[5].level	2
concepts[5].score	0.49703148007392883
concepts[5].wikidata	https://www.wikidata.org/wiki/Q868299
concepts[5].display_name	Control flow
concepts[6].id	https://openalex.org/C2780154230
concepts[6].level	2
concepts[6].score	0.4767659306526184
concepts[6].wikidata	https://www.wikidata.org/wiki/Q513420
concepts[6].display_name	Undo
concepts[7].id	https://openalex.org/C118530786
concepts[7].level	2
concepts[7].score	0.46081939339637756
concepts[7].wikidata	https://www.wikidata.org/wiki/Q1134732
concepts[7].display_name	Instrumentation (computer programming)
concepts[8].id	https://openalex.org/C199360897
concepts[8].level	1
concepts[8].score	0.4300858974456787
concepts[8].wikidata	https://www.wikidata.org/wiki/Q9143
concepts[8].display_name	Programming language
concepts[9].id	https://openalex.org/C2779960059
concepts[9].level	2
concepts[9].score	0.42964038252830505
concepts[9].wikidata	https://www.wikidata.org/wiki/Q7113681
concepts[9].display_name	Overhead (engineering)
concepts[10].id	https://openalex.org/C149635348
concepts[10].level	1
concepts[10].score	0.387448787689209
concepts[10].wikidata	https://www.wikidata.org/wiki/Q193040
concepts[10].display_name	Embedded system
keywords[0].id	https://openalex.org/keywords/computer-science
keywords[0].score	0.8527896404266357
keywords[0].display_name	Computer science
keywords[1].id	https://openalex.org/keywords/compiler
keywords[1].score	0.8084402680397034
keywords[1].display_name	Compiler
keywords[2].id	https://openalex.org/keywords/programmer
keywords[2].score	0.7916744947433472
keywords[2].display_name	Programmer
keywords[3].id	https://openalex.org/keywords/spec#
keywords[3].score	0.6796383857727051
keywords[3].display_name	Spec#
keywords[4].id	https://openalex.org/keywords/operating-system
keywords[4].score	0.49877333641052246
keywords[4].display_name	Operating system
keywords[5].id	https://openalex.org/keywords/control-flow
keywords[5].score	0.49703148007392883
keywords[5].display_name	Control flow
keywords[6].id	https://openalex.org/keywords/undo
keywords[6].score	0.4767659306526184
keywords[6].display_name	Undo
keywords[7].id	https://openalex.org/keywords/instrumentation
keywords[7].score	0.46081939339637756
keywords[7].display_name	Instrumentation (computer programming)
keywords[8].id	https://openalex.org/keywords/programming-language
keywords[8].score	0.4300858974456787
keywords[8].display_name	Programming language
keywords[9].id	https://openalex.org/keywords/overhead
keywords[9].score	0.42964038252830505
keywords[9].display_name	Overhead (engineering)
keywords[10].id	https://openalex.org/keywords/embedded-system
keywords[10].score	0.387448787689209
keywords[10].display_name	Embedded system
language	en
locations[0].id	pmh:oai:arXiv.org:1711.11396
locations[0].is_oa	True
locations[0].source.id	https://openalex.org/S4306400194
locations[0].source.issn
locations[0].source.type	repository
locations[0].source.is_oa	True
locations[0].source.issn_l
locations[0].source.is_core	False
locations[0].source.is_in_doaj	False
locations[0].source.display_name	arXiv (Cornell University)
locations[0].source.host_organization	https://openalex.org/I205783295
locations[0].source.host_organization_name	Cornell University
locations[0].source.host_organization_lineage	https://openalex.org/I205783295
locations[0].license
locations[0].pdf_url	https://arxiv.org/pdf/1711.11396
locations[0].version	submittedVersion
locations[0].raw_type	text
locations[0].license_id
locations[0].is_accepted	False
locations[0].is_published	False
locations[0].raw_source_name
locations[0].landing_page_url	http://arxiv.org/abs/1711.11396
locations[1].id	doi:10.48550/arxiv.1711.11396
locations[1].is_oa	True
locations[1].source.id	https://openalex.org/S4306400194
locations[1].source.issn
locations[1].source.type	repository
locations[1].source.is_oa	True
locations[1].source.issn_l
locations[1].source.is_core	False
locations[1].source.is_in_doaj	False
locations[1].source.display_name	arXiv (Cornell University)
locations[1].source.host_organization	https://openalex.org/I205783295
locations[1].source.host_organization_name	Cornell University
locations[1].source.host_organization_lineage	https://openalex.org/I205783295
locations[1].license
locations[1].pdf_url
locations[1].version
locations[1].raw_type	article
locations[1].license_id
locations[1].is_accepted	False
locations[1].is_published
locations[1].raw_source_name
locations[1].landing_page_url	https://doi.org/10.48550/arxiv.1711.11396
indexed_in	arxiv, datacite
authorships[0].author.id	https://openalex.org/A5046807118
authorships[0].author.orcid	https://orcid.org/0000-0002-5295-4186
authorships[0].author.display_name	Ajay Brahmakshatriya
authorships[0].author_position	first
authorships[0].raw_author_name	Ajay Brahmakshatriya
authorships[0].is_corresponding	False
authorships[1].author.id	https://openalex.org/A5012292357
authorships[1].author.orcid	https://orcid.org/0000-0002-9569-4089
authorships[1].author.display_name	Piyus Kedia
authorships[1].author_position	middle
authorships[1].raw_author_name	Piyus Kedia
authorships[1].is_corresponding	False
authorships[2].author.id	https://openalex.org/A5005035041
authorships[2].author.orcid	https://orcid.org/0000-0003-2357-7139
authorships[2].author.display_name	Derrick McKee
authorships[2].author_position	middle
authorships[2].raw_author_name	Derrick Paul McKee
authorships[2].is_corresponding	False
authorships[3].author.id	https://openalex.org/A5029139039
authorships[3].author.orcid
authorships[3].author.display_name	Pratik Bhatu
authorships[3].author_position	middle
authorships[3].raw_author_name	Pratik Bhatu
authorships[3].is_corresponding	False
authorships[4].author.id	https://openalex.org/A5026719321
authorships[4].author.orcid	https://orcid.org/0000-0002-0888-3093
authorships[4].author.display_name	Deepak Garg
authorships[4].author_position	middle
authorships[4].raw_author_name	Deepak Garg
authorships[4].is_corresponding	False
authorships[5].author.id	https://openalex.org/A5029930688
authorships[5].author.orcid	https://orcid.org/0009-0002-4359-9378
authorships[5].author.display_name	Akash Lal
authorships[5].author_position	middle
authorships[5].raw_author_name	Akash Lal
authorships[5].is_corresponding	False
authorships[6].author.id	https://openalex.org/A5102801489
authorships[6].author.orcid	https://orcid.org/0000-0003-3283-8011
authorships[6].author.display_name	Aseem Rastogi
authorships[6].author_position	last
authorships[6].raw_author_name	Aseem Rastogi
authorships[6].is_corresponding	False
has_content.pdf	False
has_content.grobid_xml	False
is_paratext	False
open_access.is_oa	True
open_access.oa_url	https://arxiv.org/pdf/1711.11396
open_access.oa_status	green
open_access.any_repository_has_fulltext	False
created_date	2025-10-10T00:00:00
display_name	CONFLLVM: A Compiler for Enforcing Data Confidentiality in Low-Level Code
has_fulltext	False
is_retracted	False
updated_date	2025-11-06T06:51:31.235846
primary_topic.id	https://openalex.org/T11424
primary_topic.field.id	https://openalex.org/fields/17
primary_topic.field.display_name	Computer Science
primary_topic.score	1.0
primary_topic.domain.id	https://openalex.org/domains/3
primary_topic.domain.display_name	Physical Sciences
primary_topic.subfield.id	https://openalex.org/subfields/1702
primary_topic.subfield.display_name	Artificial Intelligence
primary_topic.display_name	Security and Verification in Computing
related_works	https://openalex.org/W79743612, https://openalex.org/W2115968517, https://openalex.org/W2575202322, https://openalex.org/W4244323118, https://openalex.org/W2158967736, https://openalex.org/W1038420441, https://openalex.org/W2120421136, https://openalex.org/W2889297400, https://openalex.org/W1491094004, https://openalex.org/W156668154
cited_by_count	3
counts_by_year[0].year	2025
counts_by_year[0].cited_by_count	1
counts_by_year[1].year	2021
counts_by_year[1].cited_by_count	1
counts_by_year[2].year	2020
counts_by_year[2].cited_by_count	1
locations_count	2
best_oa_location.id	pmh:oai:arXiv.org:1711.11396
best_oa_location.is_oa	True
best_oa_location.source.id	https://openalex.org/S4306400194
best_oa_location.source.issn
best_oa_location.source.type	repository
best_oa_location.source.is_oa	True
best_oa_location.source.issn_l
best_oa_location.source.is_core	False
best_oa_location.source.is_in_doaj	False
best_oa_location.source.display_name	arXiv (Cornell University)
best_oa_location.source.host_organization	https://openalex.org/I205783295
best_oa_location.source.host_organization_name	Cornell University
best_oa_location.source.host_organization_lineage	https://openalex.org/I205783295
best_oa_location.license
best_oa_location.pdf_url	https://arxiv.org/pdf/1711.11396
best_oa_location.version	submittedVersion
best_oa_location.raw_type	text
best_oa_location.license_id
best_oa_location.is_accepted	False
best_oa_location.is_published	False
best_oa_location.raw_source_name
best_oa_location.landing_page_url	http://arxiv.org/abs/1711.11396
primary_location.id	pmh:oai:arXiv.org:1711.11396
primary_location.is_oa	True
primary_location.source.id	https://openalex.org/S4306400194
primary_location.source.issn
primary_location.source.type	repository
primary_location.source.is_oa	True
primary_location.source.issn_l
primary_location.source.is_core	False
primary_location.source.is_in_doaj	False
primary_location.source.display_name	arXiv (Cornell University)
primary_location.source.host_organization	https://openalex.org/I205783295
primary_location.source.host_organization_name	Cornell University
primary_location.source.host_organization_lineage	https://openalex.org/I205783295
primary_location.license
primary_location.pdf_url	https://arxiv.org/pdf/1711.11396
primary_location.version	submittedVersion
primary_location.raw_type	text
primary_location.license_id
primary_location.is_accepted	False
primary_location.is_published	False
primary_location.raw_source_name
primary_location.landing_page_url	http://arxiv.org/abs/1711.11396
publication_date	2017-11-30
publication_year	2017
referenced_works	https://openalex.org/W2075849836, https://openalex.org/W1491178396, https://openalex.org/W1999602293, https://openalex.org/W2016017569, https://openalex.org/W2514041296, https://openalex.org/W1878544538, https://openalex.org/W2089448621, https://openalex.org/W2134296086, https://openalex.org/W2105349588, https://openalex.org/W2149465027, https://openalex.org/W1981962444, https://openalex.org/W2534135179, https://openalex.org/W2102970979, https://openalex.org/W2381524979, https://openalex.org/W2741175893, https://openalex.org/W2236523039, https://openalex.org/W2153185479, https://openalex.org/W2098806455, https://openalex.org/W2752912380, https://openalex.org/W2162800072, https://openalex.org/W1969338270, https://openalex.org/W2122049982, https://openalex.org/W2397423248, https://openalex.org/W2169058020, https://openalex.org/W2040669676, https://openalex.org/W2156858199, https://openalex.org/W2155851497, https://openalex.org/W2094873755, https://openalex.org/W1874682220, https://openalex.org/W2320211919, https://openalex.org/W1565113942, https://openalex.org/W2597705742, https://openalex.org/W2087875803, https://openalex.org/W2124360577, https://openalex.org/W2158126684, https://openalex.org/W1480909796, https://openalex.org/W2100666033, https://openalex.org/W1963569294, https://openalex.org/W2470989862
referenced_works_count	39
abstract_inverted_index.a	47, 56
abstract_inverted_index.C)	16
abstract_inverted_index.In	24
abstract_inverted_index.We	0, 76, 87, 123
abstract_inverted_index.an	2, 21
abstract_inverted_index.as	81, 121
abstract_inverted_index.by	32, 129
abstract_inverted_index.in	9, 15, 17, 39, 70
abstract_inverted_index.is	104, 145
abstract_inverted_index.it	89
abstract_inverted_index.of	20, 73, 83
abstract_inverted_index.on	36, 90, 97, 136
abstract_inverted_index.to	65, 111, 142
abstract_inverted_index.12%	135
abstract_inverted_index.160	148
abstract_inverted_index.The	43
abstract_inverted_index.and	60, 96, 138
abstract_inverted_index.are	132
abstract_inverted_index.for	5, 94, 107
abstract_inverted_index.our	25, 79, 130
abstract_inverted_index.the	18, 27, 40, 71, 84, 91, 113, 117, 139
abstract_inverted_index.LLVM	85
abstract_inverted_index.LoC.	149
abstract_inverted_index.SPEC	92
abstract_inverted_index.data	7, 31, 67, 119
abstract_inverted_index.even	69
abstract_inverted_index.find	124
abstract_inverted_index.flow	49
abstract_inverted_index.have	77
abstract_inverted_index.only	146
abstract_inverted_index.part	82
abstract_inverted_index.port	143
abstract_inverted_index.such	120
abstract_inverted_index.that	125
abstract_inverted_index.then	45
abstract_inverted_index.uses	46
abstract_inverted_index.when	115
abstract_inverted_index.with	52
abstract_inverted_index.(e.g.	12
abstract_inverted_index.about	147
abstract_inverted_index.code.	42
abstract_inverted_index.leaks	68
abstract_inverted_index.marks	29
abstract_inverted_index.those	13
abstract_inverted_index.which	103
abstract_inverted_index.SPEC),	137
abstract_inverted_index.active	22
abstract_inverted_index.around	105
abstract_inverted_index.checks	64
abstract_inverted_index.custom	57, 61
abstract_inverted_index.effort	141
abstract_inverted_index.memory	58
abstract_inverted_index.scheme	80
abstract_inverted_index.secret	30
abstract_inverted_index.source	41
abstract_inverted_index.static	48
abstract_inverted_index.coupled	51
abstract_inverted_index.larger,	98
abstract_inverted_index.layout,	59
abstract_inverted_index.present	1
abstract_inverted_index.prevent	66
abstract_inverted_index.runtime	54
abstract_inverted_index.writing	33
abstract_inverted_index.written	14
abstract_inverted_index.(average	134
abstract_inverted_index.300KLoC)	106
abstract_inverted_index.OpenLDAP	144
abstract_inverted_index.analysis	50
abstract_inverted_index.attacks.	75
abstract_inverted_index.compiler	4, 44
abstract_inverted_index.evaluate	88
abstract_inverted_index.moderate	133
abstract_inverted_index.overhead	109
abstract_inverted_index.presence	19, 72
abstract_inverted_index.required	110
abstract_inverted_index.OpenLDAP,	102
abstract_inverted_index.approach,	26
abstract_inverted_index.compiler.	86
abstract_inverted_index.efficient	53
abstract_inverted_index.enforcing	6
abstract_inverted_index.integrity	63
abstract_inverted_index.low-level	10, 74
abstract_inverted_index.overheads	127
abstract_inverted_index.sensitive	118
abstract_inverted_index.top-level	37
abstract_inverted_index.(including	101
abstract_inverted_index.adversary.	23
abstract_inverted_index.introduced	128
abstract_inverted_index.passwords.	122
abstract_inverted_index.programmer	28, 108, 140
abstract_inverted_index.protecting	116
abstract_inverted_index.real-world	99
abstract_inverted_index.annotations	35
abstract_inverted_index.application	114
abstract_inverted_index.definitions	38
abstract_inverted_index.implemented	78
abstract_inverted_index.lightweight	34
abstract_inverted_index.performance	126
abstract_inverted_index.restructure	112
abstract_inverted_index.applications	11, 100
abstract_inverted_index.control-flow	62
abstract_inverted_index.performance,	95
abstract_inverted_index.instrumenting	3
abstract_inverted_index.confidentiality	8
abstract_inverted_index.instrumentation	131
abstract_inverted_index.instrumentation,	55
abstract_inverted_index.micro-benchmarks	93
cited_by_percentile_year
countries_distinct_count	0
institutions_distinct_count	7
sustainable_development_goals[0].id	https://metadata.un.org/sdg/16
sustainable_development_goals[0].score	0.46000000834465027
sustainable_development_goals[0].display_name	Peace, Justice and strong institutions
citation_normalized_percentile