Flow Control Integrity

Abstract

A method for evaluating flow control integrity, the method may include: detecting that a flow has reached a flow change command or is about to reach the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry area, wherein the entry area is the last entry area ever accessed by the flow, wherein the entry area includes a shadow stack update instruction ever executed by the flow; comparing the shadow environment identifier with the current environment identifier; and detecting a potential attack when the shadow environment identifier is different from the current environment identifier.

Description

[0001] Claiming priority rights

[0002] This patent application claims the benefit of priority to U.S. Provisional Patent Application Serial No. 63 / 003494, filed on April 1, 2020, which is incorporated herein by reference in its entirety. Background Art

[0003] Advanced driver assistance systems (ADAS) and autonomous vehicle (AV) systems use cameras and other sensors along with object classifiers designed to detect specific objects in the environment of a vehicle traveling on a road. Object classifiers are designed to detect predefined objects and are used within ADAS and AV systems to control the vehicle or warn the driver based on the type of object detected, its location, etc.

[0004] As ADAS and AV systems evolve toward fully autonomous operation, it will be beneficial to protect the data generated by these systems. Summary of the invention

[0005] The following detailed description refers to the accompanying drawings. Where possible, the same reference numerals are used in the drawings and the following description to represent the same or similar parts. Although several illustrative embodiments are described herein, modifications, adaptations, and other implementations are possible. For example, the components shown in the drawings may be replaced, added, or modified, and the illustrative methods described herein may be modified by replacing, reordering, removing, or adding steps to the disclosed methods. Accordingly, the following detailed description is not limited to the disclosed embodiments and examples.

[0006] The disclosed embodiments provide systems and methods that can be used as a component of or in conjunction with autonomous navigation / driving and / or driver assistance technology features. Driver assistance technology refers to any appropriate technology that helps the driver navigate and / or control his vehicle, such as forward collision warning (FCW), lane departure warning (LDW), and traffic sign recognition (TSR), as opposed to fully autonomous driving. In various embodiments, the system may include one, two or more camera devices that can be installed in the vehicle and an associated processor that monitors the environment of the vehicle. In other embodiments, additional types of sensors can be installed in the vehicle and can be used in autonomous navigation and / or driver assistance systems. In some examples of the currently disclosed subject matter, the system may provide technology for processing images of the environment in front of a vehicle traveling on a road for training a neural network or a deep learning algorithm to estimate the future path of the vehicle based on the image. In some other examples of the currently disclosed subject matter, the system may provide technology for processing images of the environment in front of a vehicle traveling on a road using a trained neural network to estimate the future path of the vehicle.

[0007] A system and method are provided as shown in the claims and description.

[0008] Any combination of any subject matter of any claim may be provided.

[0009] Any combination of any methods and / or method steps disclosed in any figures and / or in the specification may be provided.

[0010] Any combination of any units, devices and / or components disclosed in any figures and / or in the specification may be provided. Non-limiting examples of such units include acquisition units, image processors, and the like. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The subject matter regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of the specification. However, the invention both as to its organization and method of operation, together with objects, features, and advantages thereof, may be best understood by reference to the following detailed description when read with the accompanying drawings, in which:

[0012] Figure 1 is a block diagram representation of a system in accordance with the disclosed embodiments;

[0013] Figure 2A is a diagrammatic side view representation of an exemplary vehicle including a system in accordance with the disclosed embodiments;

[0014] Figure 2B According to the disclosed embodiments, Figure 2A a diagrammatic top view representation of the vehicle and systems shown;

[0015] Figure 2C is a diagrammatic top view representation of another embodiment of a vehicle including a system in accordance with the disclosed embodiments;

[0016] Figure 2D is a diagrammatic top view representation of yet another embodiment of a vehicle including a system in accordance with the disclosed embodiments;

[0017] Figure 2E is a diagrammatic representation of an exemplary vehicle control system in accordance with the disclosed embodiments;

[0018] Figure 3 is a diagrammatic representation of a vehicle interior including a rearview mirror and a user interface for a vehicle imaging system in accordance with a disclosed embodiment;

[0019] Figure 4 An example of the method is shown;

[0020] Figure 5 Another example of the method is shown;

[0021] Figure 6 An example of a first software environment and a shadow stack is shown; and

[0022] Figure 7 An example of a second software environment and a shadow stack is shown. DETAILED DESCRIPTION

[0023] In the following detailed description, a large number of specific details are set forth in order to provide a thorough understanding of the present invention. However, those skilled in the art will appreciate that the present invention can be implemented even without these specific details. In other cases, well-known methods, processes, and components are not described in detail in order not to affect the understanding of the present invention.

[0024] The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of the specification. However, the invention both as to its organization and method of operation, together with objects, features, and advantages thereof, will be best understood from the following detailed description read with the accompanying figures.

[0025] It will be understood that for simplicity and clarity of illustration, the elements shown in the drawings are not necessarily drawn to scale. For example, for clarity, the dimensions of some elements may be exaggerated relative to other elements. In addition, reference numerals may be repeated between the drawings to indicate corresponding or similar elements where deemed appropriate.

[0026] Because the illustrated embodiments of the present invention can be implemented to a large extent using electronic components and circuits known to those skilled in the art, details will not be described to any greater extent than deemed necessary as described above in order to understand and appreciate the basic concepts of the present invention and so as not to obscure or distract from the teachings of the present invention.

[0027] Any reference to a method in the specification is applicable, with appropriate modifications, to a system capable of executing the method and should be applicable, with appropriate modifications, to a non-transitory computer-readable medium storing instructions that, once executed by a computer, cause the execution of the method.

[0028] Any reference in the specification to the system and any other components shall apply mutatis mutandis to methods executable by the memory device and shall apply mutatis mutandis to non-transitory computer readable media storing instructions executable by the memory device. For example, methods and / or method steps performed by an image processor as described in any of the claims may be provided. For example, methods and / or method steps performed by an image processor as described in any of the claims may be provided.

[0029] Any reference in the specification to a non-transitory computer-readable medium should be applied, with appropriate modifications, to a system capable of executing instructions stored in the non-transitory computer-readable medium, and should be applied, with appropriate modifications, to a method executable by a computer that reads the instructions stored in the non-transitory computer-readable medium.

[0030] Any combination of any modules or units listed in any of the drawings, any part of the specification and / or any claims may be provided. In particular, any combination of any claimed features may be provided.

[0031] A pixel may be a picture element obtained by a camera, or may be a processed picture element.

[0032] Prior to discussing in detail examples of processing images of the environment in front of a vehicle traveling on a road for use in training a neural network or deep learning algorithm to estimate features of the vehicle's future path based on the images, or using a trained neural network to process images of the environment in front of a vehicle traveling on a road to estimate features of the vehicle's future path, a description of various possible implementations and configurations of a vehicle-mountable system is provided that can be used to perform and implement methods in accordance with examples of the presently disclosed subject matter. In some embodiments, various examples of the system can be installed in a vehicle and can be operated while the vehicle is in motion. In some embodiments, the system can implement methods in accordance with examples of the presently disclosed subject matter.

[0033] However, it will be understood that embodiments of the present disclosure are not limited to situations where suspected upright object indications are caused by high-level roads. Suspected upright object indications can be associated with various other situations and can be generated from other types of image data and also from data that is not image-based or not exclusively image-based.

[0034] Now referring to Figure 11 is a block diagram representation of a system according to the disclosed embodiments. The system 100 can include various components according to the requirements of a specific implementation. In some examples, the system 100 can include a processing unit 110, an image acquisition unit 120, and one or more memory units 140, 150. The processing unit 110 can include one or more processing devices. In some embodiments, the processing unit 110 can include an application processor 180, an image processor 190, or any other suitable processing device. Similarly, the image acquisition unit 120 can include any number of image acquisition units and components according to the requirements of a specific application. In some embodiments, the image acquisition unit 120 can include one or more image capture devices (e.g., camera devices), such as image capture device 122, image capture device 124, and image capture device 126. In some embodiments, the system 100 can also include a data interface 128, which connects the processing unit 110 to the image acquisition unit 120 in communication. For example, the data interface 128 can include one or more any wired and / or wireless links for transmitting image data acquired by the image acquisition unit 120 to the processing unit 110.

[0035] Both the application processor 180 and the image processor 190 can include various types of processing devices. For example, either or both of the application processor 180 and the image processor 190 can include one or more microprocessors, preprocessors (e.g., image preprocessors), graphics processors, central processing units (CPUs), support circuits, digital signal processors, integrated circuits, memories, or any other type of device suitable for running applications and suitable for image processing and analysis. In some embodiments, the application processor 180 and / or the image processor 190 can include any type of single-core or multi-core processor, mobile device microcontroller, central processing unit, etc. Various processing devices can be used, including, for example, processors available from manufacturers such as Intel®, AMD®, etc., and can include various architectures (e.g., x86 processors, ARM®, etc.).

[0036] In some embodiments, the application processor 180 and / or the image processor 190 can include any of the EyeQ series of processor chips available from Mobileye®. Each of these processor designs includes multiple processing units with local memory and instruction sets. Such processors may include video inputs for receiving image data from multiple image sensors, and may also include video output capabilities. In one example, EyeQ2® uses 90 nm-micro technology operating at 332 Mhz. The EyeQ2® architecture has two floating-point hyperthreaded 32-bit RISC CPUs (MIPS32® 34K® cores), five visual computing engines (VCEs), three vector microcode processors (VMP®), Denali 64-bit mobile DDR controllers, 128-bit internal Sonics interconnects, dual 16-bit video input and 18-bit video output controllers, 16-channel DMA, and several peripherals. The MIPS34K CPU manages the five VCEs, three VMP.TM. and DMA, the second MIPS34K CPU and multi-channel DMA, and other peripherals. Five VCEs, three VMPs®, and a MIPS34K CPU are capable of performing the intensive visual computations required by multi-function bundled applications. In another example, EyeQ3®, a third generation processor and six times more powerful than EyeQ2®, can be used in the disclosed examples. In yet another example, a fourth generation processor, EyeQ4®, can be used in the disclosed examples.

[0037] Although Figure 1 Two independent processing devices included in processing unit 110 are shown, but more or fewer processing devices can be used. For example, in some examples, a single processing device can be used to complete the tasks of application processor 180 and image processor 190. In other embodiments, these tasks can be performed by more than two processing devices.

[0038] The processing unit 110 can include various types of devices. For example, the processing unit 110 can include various devices, such as a controller, an image processor, a central processing unit (CPU), support circuits, a digital signal processor, an integrated circuit, a memory, or any other type of device for image processing and analysis. The image preprocessor can include a video processor for capturing, digitizing, and processing images from an image sensor. The CPU can include any number of microcontrollers or microprocessors. The support circuits can be any number of circuits generally known in the art, including caches, power supplies, clocks, and input-output circuits. The memory can store software that controls the operation of the system when executed by the processor. The memory can include a database and image processing software, including trained systems, such as neural networks. The memory can include any number of random access memories, read-only memories, flash memories, disk drives, optical storage devices, removable storage devices, and other types of storage devices. In one example, the memory can be separated from the processing unit 110. In another example, the memory can be integrated into the processing unit 110.

[0039] Each memory 140, 150 can include software instructions that, when executed by a processor (e.g., application processor 180 and / or image processor 190), can control the operation of various aspects of system 100. These memory units can include various databases and image processing software. The memory units can include random access memory, read-only memory, flash memory, disk drives, optical storage devices, tape storage devices, removable storage devices, and / or other types of storage devices. In some examples, the memory units 140, 150 can be separate from the application processor 180 and / or image processor 190. In other embodiments, these memory units can be integrated into the application processor 180 and / or image processor 190.

[0040] In some embodiments, the system can include a position sensor 130. Position sensor 130 can include any type of device suitable for determining a location associated with at least one component of system 100. In some embodiments, position sensor 130 can include a GPS receiver. Such a receiver can determine user location and velocity by processing signals broadcast by global positioning system satellites. Position information from position sensor 130 can be made available to application processor 180 and / or image processor 190.

[0041] In some embodiments, the system 100 can be operatively connected to various systems, devices, and units on a vehicle in which the system 100 can be installed, and through any suitable interface (e.g., a communication bus), the system 100 can communicate with the vehicle's systems. Examples of vehicle systems with which the system 100 can cooperate include: a throttle system, a braking system, and a steering system.

[0042] In some embodiments, system 100 can include a user interface 170. User interface 170 can include any device suitable for providing information to one or more users of system 100 or for receiving input from one or more users, including, for example, a touch screen, a microphone, a keyboard, a pointer device, a track wheel, a camera, knobs, buttons, etc. Information can be provided by system 100 to the user via user interface 170.

[0043] In some embodiments, the system 100 can include a map database 160. The map database 160 can include any type of database for storing digital map data. In some examples, the map database 160 can include data related to the location of various items (including roads, water features, geographic features, points of interest, etc.) in a reference coordinate system. The map database 160 can store not only the location of such items, but also descriptors related to those items, including, for example, names associated with any of the stored features and other information related to them. For example, the location and type of known obstacles, information related to the topography of the road, or the slope of certain points along the road, etc. can be contained in the database. In some embodiments, the map database 160 can be physically located with other components of the system 100. Alternatively or additionally, the map database 160 or a portion thereof can be remotely located relative to other components of the system 100 (e.g., the processing unit 110). In such embodiments, information from the map database 160 can be downloaded via a wired or wireless data connection to a network (e.g., via a cellular network and / or the Internet, etc.).

[0044] Image capture devices 122, 124, and 126 can each include any type of device suitable for capturing at least one image from an environment. In addition, any number of image capture devices can be used to acquire images for input to the image processor. Some examples of the presently disclosed subject matter can include or be implemented using only a single image capture device, while other examples can include or be implemented using two, three, or even four or more image capture devices. Figure 2A-2E Image capture devices 122, 124, and 126 are further described.

[0045] It will be appreciated that the system 100 can include or be operatively associated with other types of sensors, including, for example: acoustic sensors, RF sensors (e.g., radar transceivers), LIDAR sensors. Such sensors can be used independently of or in conjunction with the image acquisition unit 120. For example, data from a radar system (not shown) can be used to verify processed information received from processing images acquired by the image acquisition unit 120, such as to filter certain false positives resulting from processing images acquired by the image acquisition unit 120, or it can be combined with or otherwise supplement image data from the image acquisition unit 120 or some processed variation or derivative of the image data from the image acquisition unit 120.

[0046] The system 100 or its various components can be incorporated into a variety of different platforms. In some embodiments, the system 100 can be included in a vehicle 200, such as Figure 2A For example, vehicle 200 can be equipped with processing unit 110 and any of the other components of system 100, as described above with respect to Figure 1 Although in some embodiments, the vehicle 200 can be equipped with only a single image capture device (e.g., a camera), in combination with Figure 2A-2E In other embodiments such as those described above, multiple image capture devices can be used. For example, Figure 2A As shown, either of the image capture devices 122 and 124 of vehicle 200 can be part of an ADAS (Advanced Driver Assistance System) imaging assembly.

[0047] The image capture device included on the vehicle 200 as part of the image acquisition unit 120 can be positioned at any suitable location. Figure 2A-2E and Figure 3 As shown, the image capture device 122 can be located near the rearview mirror. This location can provide a similar line of sight to the driver of the vehicle 200, which can help determine what is visible and invisible to the driver.

[0048] Other locations of the image capture devices of the image acquisition unit 120 can also be used. For example, the image capture device 124 can be located on or in the bumper of the vehicle 200. Such a location can be particularly suitable for image capture devices with a wide field of view. The line of sight of the bumper-located image capture device can be different from the driver's line of sight. Image capture devices (such as image capture devices 122, 124, and 126) can also be located in other locations. For example, the image capture device can be located on or in one or both of the side mirrors of the vehicle 200, on the roof of the vehicle 200, on the hood of the vehicle 200, on the trunk of the vehicle 200, on the side of the vehicle 200, mounted on any of the windows of the vehicle 200, positioned behind it or positioned in front of it, and mounted in or near the light image on the front and / or rear of the vehicle 200, etc. The image acquisition unit 120 or an image capture device that is one of the multiple image capture devices used in the image acquisition unit 120 can have a field of view (FOV) that is different from the driver of the vehicle and does not always see the same object. In one example, the FOV of the image acquisition unit 120 can extend beyond the FOV of a typical driver and thus can image objects outside the driver's FOV. In yet another example, the FOV of the image acquisition unit 120 is some portion of the driver's FOV. In some embodiments, the FOV of the image acquisition unit 120 corresponds to a sector that covers an area of ​​the road ahead of the vehicle and possibly also covers the surrounding environment of the road.

[0049] In addition to the image capture device, the vehicle 200 can also include various other components of the system 100. For example, the processing unit 110 can be included on the vehicle 200, integrated with the vehicle's engine control unit (ECU), or separate. The vehicle 200 can also be equipped with a position sensor 130 (e.g., a GPS receiver), and can also include a map database 160 and memory units 140 and 150.

[0050] Figure 2A is a diagrammatic side view representation of a vehicle imaging system according to an example of the presently disclosed subject matter. Figure 2B yes Figure 2A A diagrammatic top view illustration of the example shown. Figure 2B As shown, the disclosed example can include a vehicle 200 that includes a system 100 in a vehicle body having a first image capture device 122 positioned near a rearview mirror and / or near a driver of the vehicle 200, a second image capture device 124 positioned on or in a bumper area (e.g., one of the bumper areas 210) of the vehicle 200, and a processing unit 110.

[0051] like Figure 2CAs shown, both image capture devices 122 and 124 may be positioned near a rearview mirror and / or near the driver of vehicle 200. Figure 2B and Figure 2C , two image capture devices 122 and 124 are shown, but it should be understood that other embodiments may include more than two image capture devices. Figure 2D In the illustrated embodiment, first, second, and third image capture devices 122 , 124 , and 126 are included in the system 100 of a vehicle 200 .

[0052] like Figure 2D As shown, image capture devices 122, 124, and 126 may be positioned near rearview mirrors and / or near a driver's seat of vehicle 200. The disclosed examples are not limited to any particular number and configuration of image capture devices, and image capture devices may be positioned at any suitable location within and / or on vehicle 200.

[0053] It is also understood that the disclosed embodiments are not limited to a particular type of vehicle 200 and may be applicable to all types of vehicles, including automobiles, trucks, trailers, motorcycles, bicycles, self-balancing transporters, and other types of vehicles.

[0054] The first image capture device 122 can include any suitable type of image capture device. The image capture device 122 can include an optical axis. In one example, the image capture device 122 can include an Aptina M9V024WVGA sensor with a global shutter. In another example, a rolling shutter can be used. The image acquisition unit 120 and any image capture device implemented as a component of the image acquisition unit 120 can have any desired image resolution. For example, the image capture device 122 can provide a resolution of 1280×960 pixels and can include a rolling shutter.

[0055] The image acquisition unit 120 and any image capture device implemented as part of the image acquisition unit 120 can include various optical elements. In some embodiments, one or more lenses can be included, for example, to provide an expected focal length and field of view for the image acquisition unit 120 and any image capture device implemented as part of the image acquisition unit 120. In some examples, an image capture device implemented as part of the image acquisition unit 120 can include or be associated with any optical element (e.g., a 6 mm lens or a 12 mm lens). In some examples, the image capture device 122 can be configured to capture an image with an expected (and known) field of view (FOV).

[0056] The first image capture device 122 may have a scan rate associated with the acquisition of each of the first series of image scan lines. The scan rate may represent the rate at which the image sensor is able to acquire image data associated with each pixel included in a particular scan line.

[0057] Figure 2E is a diagrammatic representation of a vehicle control system according to an example of the presently disclosed subject matter. Figure 2E As shown, the vehicle 200 can include a throttle system 220, a brake system 230, and a steering system 240. The system 100 can provide input (e.g., control signals) to one or more of the throttle system 220, the brake system 230, and the steering system 240 via one or more data links (e.g., one or more any wired and / or wireless links for transmitting data). For example, based on analysis of images acquired by the image capture devices 122, 124, and / or 126, the system 100 can provide control signals to one or more of the throttle system 220, the brake system 230, and the steering system 240 to navigate the vehicle 200 (e.g., by causing acceleration, turning, lane deviation, etc.). In addition, the system 100 can receive input from one or more of the throttle system 220, the brake system 230, and the steering system 240 indicating an operating condition of the vehicle 200 (e.g., speed, whether the vehicle 200 is braking and / or turning, etc.).

[0058] like Figure 3 As shown, the vehicle may also include a user interface 170 for interacting with the driver or passenger of the vehicle. For example, the user interface 170 in a vehicle application may include a touch screen 320, a knob 330, a button 340, and a microphone 350. The driver or passenger of the vehicle may also interact with the system 100 using a handle (e.g., located on or near the steering column of the vehicle, including, for example, a turn signal handle), a button (e.g., located on the steering wheel of the vehicle), etc. In some embodiments, the microphone 350 may be positioned adjacent to the rearview mirror 310. Similarly, in some embodiments, the image capture device 122 may be located near the rearview mirror 310. In some embodiments, the user interface 170 may also include one or more speakers 360 (e.g., speakers of a vehicle audio system). For example, the system 100 may provide various notifications (e.g., warnings) via the speaker 360.

[0059] As will be appreciated by those skilled in the art who have the benefit of this disclosure, many changes and / or modifications may be made to the above disclosed embodiments. For example, not all components are essential to the operation of the system 100. In addition, any component may be located in any appropriate portion of the system 100, and the components may be rearranged into a variety of configurations while providing the functionality of the disclosed embodiments. Therefore, the above configurations are examples, and regardless of the above-described configurations, the system 100 is capable of providing a wide range of functionality to analyze the surroundings of the vehicle, and navigate and / or otherwise control and / or operate the vehicle in response to this analysis. The navigation, control and / or operation of the vehicle may include enabling and / or disabling (directly or via an intermediate controller, such as the above-described controller) various features, components, devices, modes, systems and / or subsystems associated with the vehicle 200. Alternatively or additionally, navigation, control and / or operation may include, for example, providing visual, audio, tactile and / or other sensory alerts and / or indications and / or interactions with users, drivers, passengers, pedestrians and / or other vehicles or users that may be located inside or outside the vehicle.

[0060] As discussed in more detail below and in accordance with various disclosed embodiments, the system 100 can provide a variety of features related to autonomous driving, semi-autonomous driving, and / or driver assistance technologies. For example, the system 100 can analyze image data, location data (e.g., GPS location information), map data, speed data, and / or data from sensors included in the vehicle. The system 100 can collect data from, for example, an image acquisition unit 120, a location sensor 130, and other sensors for analysis. In addition, the system 100 can analyze the collected data to determine whether the vehicle should take a certain action, and then automatically take the determined action without human intervention. It will be understood that in some cases, the actions taken automatically by the vehicle are under human supervision, and in some cases or always enable the ability for humans to intervene, adjust, abort, or ignore machine actions. For example, when the vehicle 200 is navigating without human intervention, the system 100 can automatically control the braking, acceleration, and / or steering of the vehicle (e.g., by sending control signals to one or more of the throttle system 220, the braking system 230, and the steering system 240). In addition, the system 100 can analyze the collected data and issue warnings, instructions, recommendations, alerts, or instructions to the driver, passengers, users, or others inside or outside the vehicle (or to other vehicles) based on the analysis of the collected data. Additional details regarding various embodiments provided by the system 100 are provided below.

[0061] Return-oriented programming (ROP), also known as jump-oriented programming (JOP), is a computer security exploitation technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.

[0062] In this technique, an attacker gains control of the call stack (hereafter "the stack") to hijack program control flow, and then executes a carefully selected sequence of machine instructions that already exist in the machine's memory, called a "gadget". Each gadget typically ends with a return instruction and is located in a subroutine within existing program and / or shared library code. These gadgets are chained together, allowing an attacker to perform arbitrary operations on a machine that employs defenses that prevent simpler attacks.

[0063] Return-oriented programming is an advanced version of a stack smashing attack. Typically, these types of attacks occur when an adversary manipulates the call stack by exploiting a bug in the program, usually a buffer overrun. In a buffer overrun, such a function will accept more input data than it can properly store: the function does not perform appropriate bounds checks before storing the user-supplied data in memory. If data is being written to the stack, the excess data may overflow the space allocated to the function's variables (e.g., "locals" in the stack) and overwrite the return address. This address will later be used by the function to redirect control flow back to the caller. If it has been overwritten, control flow will go to the location specified by the new return address.

[0064] In a standard buffer overrun attack, the attacker will simply write the attack code (the "payload") onto the stack, and then overwrite the return address with the location of these newly written instructions. Until the late 1990s, major operating systems did not provide any protection against these attacks. For example, Microsoft Windows did not provide buffer overrun protection until 2004.

[0065] Eventually, operating systems began to combat the exploitation of buffer overflow bugs by marking the memory (where data was written) as non-executable, a technique called executable space protection. With this technique enabled, the machine would refuse to execute any code located in user-writable areas of memory, preventing an attacker from placing a payload on the stack and jumping to it via a return address overwrite. Hardware support later became available to enforce this protection.

[0066] With data execution prevention, the adversary cannot execute maliciously injected instructions because a typical buffer overflow overwrites the contents of the data segment of the memory, which is marked as non-executable. To overcome this, return-oriented programming attacks do not inject malicious code, but use already existing instructions called "gadgets" by manipulating the return address. Typical data execution prevention cannot defend against this attack because the adversary does not use malicious code, but instead combines "good" instructions by changing the return address; therefore, the code used is not marked as non-executable.

[0067] Return-oriented programming builds on the borrowed code block approach and extends it to provide attackers with Turing-complete functionality, including loops and conditional branches.

[0068] In other words, return-oriented programming provides a fully functional "language" that an attacker can use to cause a compromised machine to perform any desired operation. It has been demonstrated how to use return-oriented programming to emulate all important programming constructs against a target application that is linked with the C standard library and contains an exploitable buffer overflow vulnerability.

[0069] Return-oriented programming attacks outperform the other attack types discussed both in terms of expressiveness and in terms of resistance to defensive measures. None of the anti-exploitation techniques mentioned above (including completely removing potentially dangerous functions from shared libraries) are effective against return-oriented programming attacks.

[0070] A system, method, and non-transitory computer-readable medium may be provided that maintains flow control integrity by detecting return-oriented programming attacks.

[0071] When return-oriented programming attempts to jump between gadgets following a flow that is different from the program's original flow, the method verifies that the original (also called proper or uncorrupted) flow is maintained.

[0072] When executing the instructions of the software environment, the method checks whether the flow passes through the entry area of ​​the software environment, and blocks the flow from jumping to the gadget without passing through the entry area.

[0073] The entry zone may be modified (eg, by a compiler) to include shadow stack update instructions that update the shadow stack with a shadow environment identifier identifying the software environment of the entry zone.

[0074] When an attempt is made (or is to be made) to change the flow (from the current software environment), the method checks whether the shadow environment identifier is equal to the current environment identifier (which identifies the current software environment).

[0075] A mismatch indicates that the flow did not pass through the ingress zone of the current environment identifier—and a return-oriented programming attack was detected.

[0076] Figure 4 An example of a method 400 for evaluating flow control integrity is shown. The method 400 may begin with a step 410 of detecting that a flow has arrived at a flow change command or is about to arrive at a flow change command. The flow change command belongs to the current software environment. The current software environment is identified by a current environment identifier.

[0077] Examples of flow changing commands include a return command (which is used to return from a direct jump command), an indirect jump command (which can jump to an address within the current software context), and a jump subroutine command.

[0078] Detecting that the flow is about to reach a flow change command may include searching for the flow change command in the command stack even before the program counter points to the flow change command. The flow change command may be searched within a certain distance (e.g., in the vicinity—such as between 1 and 10 entries or any other value) from the entry pointed to by the program counter.

[0079] Step 410 may be followed by step 420 of retrieving a shadow environment identifier, which is the last environment identifier stored in the shadow stack. The last environment identifier may be the most recent environment identifier stored in the shadow stack.

[0080] The shadow environment identifier identifies a software environment having an entry region that is the last entry region delivered by the flow. The entry region includes shadow stack update instructions executed by the flow.

[0081] Step 420 may be followed by step 430 of comparing the shadow environment identifier with the current environment identifier.

[0082] When the shadow environment identifier is different from the current environment identifier, then step 430 may be followed by a step 440 of detecting a potential attack. The potential attack may be a return-oriented programming attack.

[0083] Step 440 may be followed by step 450 of responding to the detection of a potential attack. The response may include generating an alert, stopping execution of the flow, restarting the processor, and the like.

[0084] When the shadow context identifier is equal to the current context identifier, then step 430 may be followed by step 460 of executing a stream change command.

[0085] Step 460 may include at least one of the following steps:

[0086] 1) Execute step 461 of the return command.

[0087] 2) Step 464 of executing the jump subroutine command.

[0088] 3) Step 467 of executing the indirect jump instruction.

[0089] Step 461 may include steps 462 and 463 .

[0090] Step 462 may include retrieving a return environment identifier identifying the return software environment from the shadow stack.Step 462 may be followed by step 463 of jumping (returning) to the return software environment.

[0091] Step 464 may include steps 465 and 466. Step 465 may include jumping to the subroutine. Step 466 may include performing a shadow stack update included in an entry region of the subroutine. Step 466 may include storing a shadow context identifier identifying the subroutine in the shadow stack.

[0092] Figure 5 is another example of method 500. Method 500 differs from method 400 in that it includes step 470 of receiving a program (e.g., a high-level program) and converting the program into a machine language program (also referred to as code) by a compiler. The conversion may include modifying an entry region of at least one software environment of the machine language program to include a shadow stack update instruction, the shadow stack update instruction updates a shadow stack with a shadow environment identifier, the shadow environment identifier identifying the software environment including the entry region.

[0093] also, Figure 5 Steps 461 - 467 are not shown (to simplify the illustration).

[0094] Figure 6 An example of a first software environment 610 and a shadow stack 630 is shown. The first software environment 610 includes a first entry area 611 and one or more other parts 612, the one or more other parts 612 including a first gadget 621, a flow change command such as a "jump to second software environment" command 622, and a check control flow integrity command 624. The jump command can be a direct or indirect jump command.

[0095] If the flow executes the first software environment 610 in an appropriate manner, starting from executing instructions of the first entry region 611 , the flow will execute shadow stack update instructions such as “update shadow stack with ID (ENV1)” 613 , where ID (ENV1) identifies the first software environment 610 .

[0096] If, as a result of a return-oriented programming attack, flow reaches the first software environment 610 without passing through the first entry region 611, the shadow stack will not be updated with the ID (ENV1).

[0097] Instructions within one or more other portions 612 are executed until (or before) a control flow integrity command 624 is reached, which compares the ID (ENV1) with the shadow environment identifier stored in the shadow stack 630 and responds based on the result of the comparison.

[0098] Figure 6The following situation is shown, in which the flow executes the first software environment 610 in an appropriate manner and executes "update shadow stack with ID (ENV1)" 613, so that the shadow environment identifier 631 stored in the shadow stack 630 is equal to ID (ENV1). In this case, the flow continues to execute the jump to the second software environment command.

[0099] Otherwise, the shadow stack 630 will not store the ID (ENV1) and an attack is detected.

[0100] Figure 7 An example of a second software environment 640 and a shadow stack 630 is shown.

[0101] The second software environment 640 includes a second entry area 641 and one or more other parts 642 including a second gadget 651 , flow changing commands such as return 652 (return to the first software environment), and a check control flow integrity command 654 .

[0102] When the flow successfully jumps from the first software environment to the second entry area 641 of the second software environment, it executes the Update Shadow Stack with ID (ENV2) command 643, and the shadow stack 630 stores ID (ENV2) 632. The shadow stack 630 also stores ID (ENV1) 631 as a return environment identifier.

[0103] In this case, execution of the check control flow integrity command 654 will indicate that a return command may be executed and the flow will use the return environment identifier ID (ENV1) 631 for returning to the first software environment.

[0104] If the second gadget 651 is reached without passing through the second entry region 641 , the check control integrity command 654 will find that ID(ENV2) is different from the shadow environment identifier (eg, ID(ENV1)) and detect an attack.

[0105] Any of the machine language programs mentioned above can be written by Figures 2A-2D The processing unit 110 may be executed by the processor 110, or may be executed by any processor that may include one or more processing circuits. The processing circuit may include one or more field programmable gate arrays (FPGAs), one or more graphics processing units (GPUs), one or more general purpose units, one or more central processing units (CPUs), one or more hardware accelerators, one or more integrated circuits, etc.

[0106] Any of the methods of describing steps may include more steps than those shown in the figure, include only the steps shown in the figure, or include substantially only the steps shown in the figure. The same applies to components of an apparatus, processor, or system, and to instructions stored in a non-transitory computer-readable storage medium.

[0107] The present invention can also be implemented by a computer program running on a computer system, which at least includes a code portion for executing the steps of the method according to the present invention or enabling the programmable device to perform the functions of the apparatus or system according to the present invention when running on a programmable device (such as a computer system). The computer program can cause the storage system to allocate a disk drive to a disk drive group.

[0108] A computer program is a list of instructions such as a specific application and / or an operating system. A computer program may include, for example, one or more of the following: subroutines, functions, procedures, object methods, object implementations, executable applications, applets, servlets, source code, object code, shared libraries / dynamically loaded libraries, and / or other sequences of instructions designed to be executed on a computer system.

[0109] The computer program may be stored internally on a non-transitory computer readable medium. All or some of the computer program may be permanently provided on a computer readable medium that is removable or remotely coupled to an information processing system. The computer readable medium may include, for example and without limitation, any number of the following: magnetic storage media, including magnetic disks and tape storage media; optical storage media, such as compact disk media (e.g., CD-ROM, CD-R, etc.) and digital video disk storage media; non-volatile memory storage media, including semiconductor-based memory cells, such as flash memory, EEPROM, EPROM, ROM; ferroelectric digital memory; MRAM; volatile storage media, including registers, buffers or caches, main memory, RAM, etc.

[0110] A computer process typically consists of an executing (running) program or portion of a program, current program values ​​and state information, and resources used by the operating system to manage the execution of the process. An operating system (OS) is software that manages the sharing of a computer's resources and provides programmers with an interface for accessing those resources. An operating system processes system data and user input, and responds by allocating and managing tasks and internal system resources as services to the system's users and programs.

[0111] A computer system may include, for example, at least one processing unit or processing circuit, associated memory, and a plurality of input / output (I / O) devices. When executing a computer program, the computer system processes information according to the computer program and generates output information via the I / O devices.

[0112] Example

[0113] Example 1 is a system comprising a processing circuit configured to: detect that a flow has arrived at a flow change command or is about to arrive at the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieve a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry area, wherein the entry area is the last entry area ever accessed by the flow, wherein the entry area includes a shadow stack update instruction ever executed by the flow; compare the shadow environment identifier with the current environment identifier; and detect a potential attack when the shadow environment identifier is different from the current environment identifier.

[0114] In Example 2, the subject matter of Example 1 includes wherein the current environment identifier is stored adjacent to the stream change command.

[0115] In Example 3, the subject matter of Examples 1-2 includes, wherein after said detecting said potential attack, execution of said flow is stopped.

[0116] In Example 4, the subject matter of Examples 1-3 includes wherein the entry region was modified by a compiler to include the shadow stack update instruction.

[0117] In Example 5, the subject matter of Examples 1-4 includes modifying, by a compiler, the entry region to include the shadow stack update instruction.

[0118] In Example 6, the subject matter of Examples 1-5 includes executing the stream change command when the shadow environment identifier is equal to the current environment identifier.

[0119] In Example 7, the subject matter according to Example 6 includes, wherein the flow change command is a return command; and wherein execution of the return command includes: (i) retrieving a return environment identifier identifying a return software environment from the shadow stack; and (ii) jumping to the return software environment.

[0120] In Example 8, the subject matter according to Examples 6-7 includes, wherein the flow change command is a jump to subroutine command for jumping to a subroutine; and wherein execution of the jump to subroutine command includes: jumping to the subroutine and performing a shadow stack update included in the entry area of ​​the subroutine; wherein the execution of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

[0121] In Example 9, the subject matter of Examples 6-8 includes, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

[0122] In Example 10, the subject matter of Examples 1-9 includes wherein the flow change command is a jump subroutine command.

[0123] In Example 11, the subject matter of Examples 1-10 includes wherein the flow change command is a return command.

[0124] In Example 12, the subject matter of Examples 1-11 includes wherein the flow change command is a jump indirect command.

[0125] Example 13 is a method for evaluating flow control integrity, the method comprising: detecting that a flow has reached a flow change command or is about to reach the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is the last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry area, wherein the entry area is the last entry area ever accessed by the flow, wherein the entry area includes a shadow stack update instruction ever executed by the flow; comparing the shadow environment identifier with the current environment identifier; and detecting a potential attack when the shadow environment identifier is different from the current environment identifier.

[0126] In Example 14, the subject matter of Example 13 includes wherein the current environment identifier is stored adjacent to the stream change command.

[0127] In Example 15, the subject matter of Examples 13-14 includes, wherein after said detecting said potential attack, execution of said flow is stopped.

[0128] In Example 16, the subject matter of Examples 13-15 includes wherein the entry region was modified by a compiler to include the shadow stack update instruction.

[0129] In Example 17, the subject matter of Examples 13-16 includes modifying, by a compiler, the entry region to include the shadow stack update instruction.

[0130] In Example 18, the subject matter of Examples 13-17 includes executing the stream change command when the shadow environment identifier is equal to the current environment identifier.

[0131] In Example 19, the subject matter according to Example 18 includes, wherein the flow change command is a return command; and wherein execution of the return command includes: (i) retrieving a return environment identifier identifying a return software environment from the shadow stack; and (ii) jumping to the return software environment.

[0132] In Example 20, the subject matter according to Examples 18-19 includes, wherein the flow change command is a jump to subroutine command for jumping to a subroutine; and wherein execution of the jump to subroutine command includes: jumping to the subroutine and performing a shadow stack update included in the entry area of ​​the subroutine; wherein the execution of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

[0133] In Example 21, the subject matter of Examples 18-20 includes, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

[0134] In Example 22, the subject matter of Examples 13-21 includes wherein the flow change command is a jump subroutine command.

[0135] In Example 23, the subject matter of Examples 13-22 includes wherein the flow change command is a return command.

[0136] In Example 24, the subject matter of Examples 13-23 includes wherein the flow change command is a jump indirect command.

[0137] Example 25 is a non-temporary computer-readable medium storing instructions that, when executed on a processing circuit, cause the processing circuit to perform operations, the operations comprising: detecting that a flow has arrived at a flow change command or is about to arrive at the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry area, wherein the entry area is the last entry area ever accessed by the flow, wherein the entry area includes a shadow stack update instruction ever executed by the flow; comparing the shadow environment identifier with the current environment identifier; and detecting a potential attack when the shadow environment identifier is different from the current environment identifier.

[0138] In Example 26, the subject matter of Example 25 includes, wherein the current environment identifier is stored adjacent to the stream change command.

[0139] In Example 27, the subject matter of Examples 25-26 includes, wherein after said detecting said potential attack, execution of said flow is stopped.

[0140] In Example 28, the subject matter of Examples 25-27 includes wherein the entry region was modified by a compiler to include the shadow stack update instruction.

[0141] In Example 29, the subject matter of Examples 25-28 includes storing instructions for modifying, by a compiler, the entry region to include the shadow stack update instructions.

[0142] In Example 30, the subject matter of Examples 25-29 includes storing instructions for executing the stream change command when the shadow environment identifier is equal to the current environment identifier.

[0143] In Example 31, the subject matter according to Example 30 includes, wherein the flow change command is a return command; and wherein execution of the return command includes: (i) retrieving a return environment identifier identifying a return software environment from the shadow stack; and (ii) jumping to the return software environment.

[0144] In Example 32, the subject matter according to Examples 30-31 includes, wherein the flow change command is a jump to subroutine command for jumping to a subroutine; and wherein execution of the jump to subroutine command includes: jumping to the subroutine and performing a shadow stack update included in the entry area of ​​the subroutine; wherein the execution of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

[0145] In Example 33, the subject matter of Examples 30-32 includes, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

[0146] In Example 34, the subject matter of Examples 25-33 includes wherein the flow change command is a jump subroutine command.

[0147] In Example 35, the subject matter of Examples 25-34 includes wherein the flow change command is a return command.

[0148] In Example 36, the subject matter of Examples 25-35 includes wherein the flow change command is a jump indirect command.

[0149] Example 37 is at least one machine-readable medium comprising instructions that, when executed by a processing circuit, cause the processing circuit to perform operations to implement any of Examples 1-36.

[0150] Example 38 is an apparatus comprising means for implementing any of Examples 1-36.

[0151] Example 39 is a system for implementing any of Examples 1-36.

[0152] Example 40 is a method for implementing any of Examples 1-36.

[0153] In the foregoing specification, the invention has been described with reference to specific examples of embodiments of the invention. It will be evident that various modifications and changes may be made therein without departing from the broader spirit and scope of the invention as set forth in the appended claims.

[0154] Furthermore, the terms "front", "rear", "top", "bottom", "above", "below", etc., if any, in the description and claims are used for descriptive purposes and not necessarily for describing permanent relative positions. It is to be understood that any of the terms so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein are, for example, capable of operation in orientations other than those shown or described herein.

[0155] As described herein, the connection may be any type of connection suitable for transmitting signals from / to a corresponding node, unit or device, for example, via an intermediate device. Accordingly, unless otherwise implied or indicated, the connection may be, for example, a direct connection or an indirect connection. The connection may be shown or described with reference to being a single connection, multiple connections, a unidirectional connection or a bidirectional connection. However, different embodiments may change the implementation of the connection. For example, an independent unidirectional connection may be used instead of a bidirectional connection, and vice versa. In addition, a single connection that transmits multiple signals in sequence or in a time-multiplexed manner may be used to replace multiple connections. Similarly, a single connection that carries multiple signals may be separated into various different connections that carry a subset of these signals. Therefore, many options exist for transmitting signals.

[0156] Although specific conductivity types or polarities of potentials have been described in the examples, it will be appreciated that the conductivity types and polarities of potentials may be reversed.

[0157] Each of the signals described herein may be designed as positive or negative logic. In the case of a negative logic signal, the signal is an active low level, wherein the logically true state corresponds to a logic level zero. In the case of a positive logic signal, the signal is an active high level, wherein the logically true state corresponds to a logic level one. It is noted that any of the signals described herein may be designed as a negative or positive logic signal. Thus, in alternative embodiments, those signals described as positive logic signals may be implemented as negative logic signals, and those signals described as negative logic signals may be implemented as positive logic signals.

[0158] Additionally, the terms "assert" or "set" and "negate" (or "de-assert" or "clear") are used herein when referring to causing a signal, status bit, or the like to enter its logically true or logically false state, respectively. If the logically true state is a logic level one, the logically false state is a logic level zero. And if the logically true state is a logic level zero, the logically false state is a logic level one.

[0159] Those skilled in the art will appreciate that the boundaries between logic blocks are merely illustrative, and that alternative embodiments may merge logic blocks or circuit elements, or impose alternative decompositions of functionality on various logic blocks or circuit elements. It is therefore to be understood that the architectures shown herein are merely exemplary, and that in fact many other architectures may be implemented that achieve the same functionality.

[0160] Any arrangement of components that achieve the same functionality is effectively "associated" such that the intended functionality is achieved. Thus, any two components combined herein to achieve a particular functionality may be viewed as being "associated" with each other such that the intended functionality is achieved, regardless of architectures or intermediate components. Likewise, any two components so associated can also be viewed as being "operably connected" or "operably coupled" to each other such that the intended functionality is achieved.

[0161] In addition, those skilled in the art will appreciate that the boundaries between the above operations are illustrative only. Multiple operations may be combined into a single operation, a single operation may be distributed in additional operations, and operations may overlap at least in part in time. In addition, alternative embodiments may include multiple instances of specific operations, and the order of operations may change in various other embodiments.

[0162] For another example, in one embodiment, the illustrated examples may be implemented as circuits located on a single integrated circuit or within the same device. Alternatively, the examples may be implemented as any number of separate integrated circuits or separate devices interconnected with each other in a suitable manner.

[0163] As another example, the examples or portions thereof may be implemented as soft or code representations of physical circuitry or may be converted into logical representations of physical circuitry, such as by any appropriate type of hardware description language.

[0164] In addition, the present invention is not limited to physical devices or units implemented by non-programmable hardware, but can also be applied to programmable devices or units that can perform the intended device functions by operating according to appropriate program codes, such as mainframe computers, microcomputers, servers, workstations, personal computers, notepads, personal digital assistants, electronic games, automobiles and other embedded systems, cellular phones and various other wireless devices, generally referred to as 'computer systems' in this application.

[0165] However, other modifications, changes and alternatives are possible.The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

[0166] In the claims, any reference numerals placed between brackets should not be construed as limiting the claim. The word 'comprising' does not exclude the presence of elements or steps other than those listed in the claim. In addition, the term "a" as used herein is defined as one or more than one. In addition, the use of introductory words such as "at least one" and "one or more" in the claims should not be understood as implying that any particular claim containing such introduced claim element is limited to an invention containing only one such element by introducing another claim element through the indefinite article "a", even when the same claim includes the introductory words "one or more" or "at least one" and indefinite articles such as "a". The same is true for the use of definite articles. Unless otherwise specified, terms such as "first" and "second" are used to arbitrarily distinguish the elements described by such terms. Therefore, these terms are not necessarily intended to indicate the time or other prioritization of such elements. The fact that certain measures are stated in mutually different claims does not mean that the combination of these measures cannot be used to produce good results.

[0167] While certain features of the invention have been shown and described herein, numerous modifications, permutations, changes, and equivalents will now occur to those skilled in the art. It is therefore to be understood that the appended claims are intended to cover all such modifications and changes that fall within the true spirit of the invention.

Claims

1. A system for evaluating flow control integrity, comprising a processing circuit, the processing circuit being configured to: detecting that a flow has arrived at a flow change command or is about to arrive at the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry region that is a last entry region visited by the flow, wherein the entry region includes a shadow stack update instruction that was executed by the flow; comparing the shadow environment identifier with the current environment identifier; detecting a potential attack when the shadow environment identifier is different from the current environment identifier; as well as When the shadow environment identifier is equal to the current environment identifier, the stream change command is executed.

2. The system of claim 1, wherein to detect that the flow is about to reach the flow change command, the processing circuit is configured to search for the flow change command near an entry pointed to by a program counter.

3. The system of claim 1, wherein after said detecting said potential attack, execution of said flow is stopped. 4 . The system of claim 1 , wherein the entry region was modified by a compiler to include the shadow stack update instruction. 5 . The system of claim 1 , wherein the processing circuit is configured to modify the entry region by a compiler to include the shadow stack update instruction.

6. The system of claim 1 , wherein the flow change command is a return command; and wherein the execution of the return command comprises: Retrieving a return environment identifier identifying a return software environment from the shadow stack; And jump to the return software environment.

7. The system of claim 1 , wherein the flow change command is a jump subroutine command for jumping to a subroutine; and wherein the execution of the jump subroutine command comprises: jumping to the subroutine and performing a shadow stack update included in the entry region of the subroutine; Wherein the performing of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

8. The system of claim 1, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

9. The system of claim 1, wherein the flow change command is a jump subroutine command.

10. The system of claim 1, wherein the flow change command is a return command.

11. The system of claim 1, wherein the flow change command is a jump indirect command.

12. The system according to any one of claims 1-11, wherein the current software environment comprises a current software environment entry area, and the current software environment entry area comprises a shadow stack update instruction for updating the shadow stack with the current environment identifier.

13. The system of any one of claims 1-11, wherein the processing circuit is configured to detect the potential attack before executing the flow change command.

14. The system of claim 13, wherein the processing circuit is configured to respond to detecting the potential attack prior to executing the flow change command.

15. The system of claim 14, wherein the processing circuit is configured to respond by performing at least one of: generating an alert, stopping the execution of the flow, or restarting a processor.

16. A method for evaluating flow control integrity, comprising: detecting that a flow has arrived at a flow change command or is about to arrive at the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry region that is a last entry region visited by the flow, wherein the entry region includes a shadow stack update instruction that was executed by the flow; comparing the shadow environment identifier with the current environment identifier; detecting a potential attack when the shadow environment identifier is different from the current environment identifier; as well as When the shadow environment identifier is equal to the current environment identifier, the stream change command is executed.

17. The method of claim 16, wherein said detecting that the flow is about to reach the flow change command comprises searching for the flow change command near an entry pointed to by a program counter. The method of claim 16 , wherein after said detecting said potential attack, execution of said flow is stopped.

19. The method of claim 16, wherein the entry region was modified by a compiler to include the shadow stack update instruction.

20. The method of claim 16, comprising modifying, by a compiler, the entry region to include the shadow stack update instruction.

21. The method of claim 16, wherein the flow change command is a return command; and wherein the execution of the return command comprises: Retrieving a return environment identifier identifying a return software environment from the shadow stack; And jump to the return software environment.

22. The method of claim 16, wherein the flow change command is a jump subroutine command for jumping to a subroutine; and wherein the executing of the jump subroutine command comprises: jumping to the subroutine and performing a shadow stack update included in the entry region of the subroutine; Wherein the performing of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

23. The method of claim 16, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

24. The method of claim 16, wherein the flow change command is a jump subroutine command.

25. The method of claim 16, wherein the flow change command is a return command.

26. The method of claim 16, wherein the flow change command is a jump indirect command.

27. The method according to any one of claims 16-26, wherein the current software environment comprises a current software environment entry area, and the current software environment entry area comprises a shadow stack update instruction for updating the shadow stack with the current environment identifier.

28. The method of any of claims 16-26, wherein said detecting said potential attack occurs prior to executing said flow change command.

29. The method of claim 28, comprising responding to said detecting of said potential attack prior to executing said flow change command.

30. The method of claim 29, wherein the response comprises at least one of: generating an alert, stopping the execution of the flow, or restarting a processor.

31. A non-transitory computer-readable medium storing instructions that, when executed on a processing circuit, cause the processing circuit to perform operations comprising: detecting that a flow has arrived at a flow change command or is about to arrive at the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry region that is a last entry region visited by the flow, wherein the entry region includes a shadow stack update instruction that was executed by the flow; comparing the shadow environment identifier with the current environment identifier; detecting a potential attack when the shadow environment identifier is different from the current environment identifier; as well as When the shadow environment identifier is equal to the current environment identifier, the stream change command is executed.

32. The non-transitory computer readable medium of claim 31, wherein the detecting that the flow is about to reach the flow change command comprises searching for the flow change command near an entry pointed to by a program counter.

33. The non-transitory computer-readable medium of claim 31 , wherein subsequent to said detecting said potential attack, execution of said flow is stopped.

34. The non-transitory computer-readable medium of claim 31, wherein the entry region was modified by a compiler to include the shadow stack update instruction.

35. The non-transitory computer readable medium of claim 31 storing instructions for a compiler to modify the entry region to include the shadow stack update instructions.

36. The non-transitory computer-readable medium of claim 31 , wherein the flow change command is a return command; and wherein execution of the return command comprises: Retrieving a return environment identifier identifying a return software environment from the shadow stack; And jump to the return software environment.

37. The non-transitory computer-readable medium of claim 31 , wherein the flow change command is a jump subroutine command for jumping to a subroutine; and wherein the execution of the jump subroutine command comprises: jumping to the subroutine and performing a shadow stack update included in the entry region of the subroutine; Wherein the performing of the shadow stack update includes storing a shadow environment identifier identifying the subroutine in the shadow stack.

38. The non-transitory computer-readable medium of claim 31, wherein the flow change command is a jump indirect command for jumping to an address stored in a memory element; wherein the address belongs to the current software environment.

39. The non-transitory computer readable medium of claim 31, wherein the flow change command is a jump subroutine command.

40. The non-transitory computer readable medium of claim 31, wherein the flow change command is a return command.

41. The non-transitory computer readable medium of claim 31, wherein the flow change command is a jump indirect command.

42. The non-transitory computer-readable medium of any one of claims 31-41, wherein the current software environment comprises a current software environment entry area, the current software environment entry area comprising shadow stack update instructions for updating the shadow stack with the current environment identifier.

43. The non-transitory computer-readable medium of any one of claims 31-41, wherein the detecting the potential attack occurs prior to executing the flow change command.

44. The non-transitory computer readable medium of claim 43 storing instructions for responding to the detecting of the potential attack prior to executing the flow change command.

45. The non-transitory computer-readable medium of claim 44, wherein the response comprises at least one of: generating an alert, stopping the execution of the flow, or restarting a processor.

Images