Control flow integrity system and method

Abstract

A CFI system comprising: at least one protection module, each protection module comprising a respective allowed flow model associated with at least one of a plurality of parts of a process; and at least one process protection manager arranged, in response to a control flow instruction in one of the plurality of parts of the process, to: compare one or more parameters of the control flow instruction with the allowed flow model of the associated protection module; and generate a predetermined signal in response to a result of the comparison indicating that the compared parameters do not satisfy respective parameters of the allowed flow model, wherein each protection module is implemented as a shared object, wherein each process protection manager is implemented as a shared object, and wherein the at least one protection module and process protection manager are loaded into the process.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Provisional Application S / N 62 / 966,573, filed January 28, 2020, entitled “CONTROL FLOW INTEGRITY SYSTEMAND METHOD,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] This invention relates generally to the field of control flow integrity safety devices, and more specifically to control flow integrity systems and methods for control flow integrity in one or more processes.

[0004] background

[0005] In computing, a linker, or linker editor, is a computer utility that receives one or more object files generated by a compiler or assembler and combines them into a single executable file, library file, or another 'object' file. Common linking methods include static linking and dynamic linking. Static linking is the result of the linker copying all library routines used by the program into the executable file. Compared to dynamic linking, this may require more disk space and memory, but it is more portable because it does not require the libraries to exist on the system on which it runs.

[0006] Many operating system environments allow dynamic linking, which postpones the resolution of some undefined symbols until the program runs. This means that the executable code still contains undefined symbols, along with a list of objects or libraries that will provide definitions for these undefined symbols. The loader also loads these objects / libraries and performs the final linking. An Executable Linkable Format (ELF) file is a file composed of symbol lookups and relocatable tables, meaning it can be loaded by the kernel at any memory address, and all symbols used are automatically adjusted to offsets from the memory address where they are loaded. One way to protect ELF files from runtime exploits is to add Control Flow Integrity (CFI) checks. CFI is a generic term for computer security techniques that prevent various malware attacks from redirecting the execution flow of a program. Different methods exist for adding CFI checks to binaries.

[0007] For statically linked executables, all code is added to the executable before execution. Therefore, in this case, the CFI check is added to the executable. Final linking is completed before the ELF file is run, so the CFI can be added to the ELF file before runtime. For dynamically linked executables, final linking is performed by the loader at runtime. Therefore, the CFI check can be added after shared objects are added to the process's memory.

[0008] In the automotive market, CFI checks need to be added to electrical control units (ECUs), domain controller units (DCUs), and other endpoints such as telematics control units (TCUs). CFI has four main unique areas in the automotive market:

[0009] 1. Zero false positive - CFI tests should be 100% definitive and should not generate false alarms;

[0010] 2. Real-time performance - CFI checks should not add more than a few microseconds of latency to the stream;

[0011] 3. High security - CFI checks should be difficult to circumvent; and

[0012] 4. Easy to maintain - CFI checks should be easy to update, as it is difficult to update the ECU in a vehicle.

[0013] Most CFI solutions currently on the market are designed to protect industrial / organizational computers, Internet of Things (IoT) devices, etc. Therefore, they do not meet the zero false positive standard.

[0014] Furthermore, CFI solutions commonly found in the market are based on cryptography, writing cookies / magic values, etc. These methods are not performed in real time. Additionally, in methods based on writing cookies to storage, the storage for those cookies must be writable, thus allowing attackers to write to that area and manipulate the cookies.

[0015] Public Overview

[0016] Accordingly, it is a primary object of the present application to overcome at least some of the disadvantages of the prior art CFI methods and arrangements. This is provided in one embodiment by a CFI system comprising: at least one protection module, each of the at least one protection module comprising a respective allowable flow model associated with at least one of a plurality of portions of a process; and at least one process protection manager, a respective process protection manager of the at least one process protection manager being arranged to, in response to a control flow instruction in one of the plurality of portions of the process: compare one or more parameters of the control flow instruction with the allowable flow model of the associated protection module; and generate a predetermined signal in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the respective allowable flow model, wherein each of the at least one protection module is implemented as a shared object, wherein each of the at least one process protection manager is implemented as a shared object, and wherein the at least one protection module and process protection manager are loaded into the process.

[0017] In one embodiment, the parameter comparison and signal generation of the respective process protection manager is in response to a control flow instruction associated with the respective protection module. In another embodiment, the control flow instruction associated with the respective protection module comprises a predetermined branch instruction to the process protection manager. In another embodiment, the parameter comparison and signal generation of the at least one process protection manager is further in response to information sent to the respective process protection manager in response to the control flow instruction associated with the respective protection module.

[0018] In one embodiment, the control flow instruction in a first portion of the plurality of portions of the process comprises a branch or a call to an address associated with a second portion of the plurality of portions of the process, the comparison is with respect to the allowable flow model of the protection module associated with the second portion of the process. In another embodiment, the at least one protection module comprises a plurality of protection modules, wherein, in response to the associated flow model not containing the respective parameter, the respective process protection manager is further arranged to: compare the one or more parameters of the control flow instruction with the allowable flow model of another protection module of the plurality of protection modules; and generate the predetermined signal in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the respective allowable flow model.

[0019] In one embodiment, each of the plurality of portions of the process is associated with a respective file of the plurality of files, wherein in response to a first file of the plurality of files exhibiting a predetermined indication, the respective process protection manager loads a respective protection model shared object associated with the first file, and wherein in response to a second file of the plurality of files not exhibiting the predetermined indication, the respective process protection manager does not load a respective protection model shared object associated with the second file. In another embodiment, the at least one process protection manager comprises a plurality of process protection managers, each process protection manager exhibiting a respective predetermined rule, the comparison is responsive to the respective predetermined rule of the respective process protection manager, and wherein a respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

[0020] In one embodiment, the at least one process protection manager comprises a plurality of process protection managers, wherein a generated signal of a first process protection manager of the plurality of process protection managers is arranged to prevent operation of a respective control flow instruction, whereas a generated signal of a second process protection manager of the plurality of process protection managers is not arranged to prevent operation of a respective control flow instruction, and wherein a respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process. In another embodiment, a first portion of the plurality of portions of the process is associated with an executable file, and a second portion of the plurality of portions of the process is associated with a shared object file.

[0021] In one embodiment, the respective process protection manager is loaded into a plurality of processes. In another embodiment, each of the at least protection modules exhibits an indication of which parameters are used in the respective comparison.

[0022] In one independent embodiment, a control flow integrity system comprises a processor and a memory, the processor arranged to load into a process, in response to instructions stored in the memory: at least one protection module; and a process protection manager, wherein the loaded process protection manager is arranged to: compare one or more parameters of a control flow instruction to an allowed flow model of an associated protection module; and generate a predetermined signal in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the respective allowed flow model, wherein each of the at least one protection module is implemented as a shared object, and wherein each of the at least one process protection manager is implemented as a shared object.

[0023] In one embodiment, the parameter comparison and signal generation of the loaded process protection manager is responsive to a control flow instruction associated with the corresponding protection module. In another embodiment, the control flow instruction associated with the corresponding protection module comprises a predetermined branch instruction to the process protection manager. In another embodiment, the parameter comparison and signal generation of the loaded process protection manager is further responsive to information sent to the loaded process protection manager in response to the control flow instruction associated with the corresponding protection module.

[0024] In one embodiment, the control flow instruction in the first portion of the plurality of portions of the process comprises a branch or a call to an address associated with a second portion of the plurality of portions of the process, the comparison is with respect to an allowed flow model of a protection module associated with the second portion of the process. In another embodiment, the at least one protection module comprises a plurality of protection modules, wherein, responsive to the associated flow model not containing the corresponding parameter, the process protection manager is further arranged to: compare the one or more parameters of the control flow instruction with an allowed flow model of another protection module of the plurality of protection modules; and generate the predetermined signal responsive to a result of the comparison indicating that the compared one or more parameters do not satisfy the corresponding parameter of the corresponding allowed flow model.

[0025] In one embodiment, each portion of the plurality of portions of the process is associated with a corresponding file of a plurality of files, wherein, responsive to a first file of the plurality of files exhibiting a predetermined indication, the process protection manager loads a corresponding protection model shared object associated with the first file, and wherein, responsive to a second file of the plurality of files not exhibiting the predetermined indication, the process protection manager does not load a corresponding protection model shared object associated with the second file. In another embodiment, the process protection manager is one of a plurality of process protection managers, each process protection manager exhibiting a corresponding predetermined rule, the comparison is responsive to the corresponding predetermined rule of the corresponding process protection manager, and wherein a corresponding process protection manager of the plurality of process protection managers is selected responsive to a predetermined characteristic of the process.

[0026] In one embodiment, the process protection manager is one of a plurality of process protection managers, wherein the generated signal of a first process protection manager of the plurality of process protection managers is arranged to prevent operation of the corresponding control flow instruction, and the generated signal of a second process protection manager of the plurality of process protection managers is not arranged to prevent operation of the corresponding control flow instruction, and wherein a corresponding process protection manager of the plurality of process protection managers is selected responsive to a predetermined characteristic of the process. In another embodiment, a first portion of the plurality of portions of the process is associated with an executable file and a second portion of the plurality of portions of the process is associated with a shared object file.

[0027] In one embodiment, the process protection manager is loaded into a plurality of processes. In another embodiment, at least each of the protection modules exhibits an indication of which parameters are used in the respective comparison.

[0028] In another independent embodiment, there is provided a control flow integrity method, the method comprising: loading at least one protection module into a process; and loading a process protection manager into the process, wherein the loaded process protection manager is arranged to: compare one or more parameters of a control flow instruction with an associated protection module's allowed flow model; and in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the respective allowed flow model, generate a predetermined signal, wherein each of the at least one protection modules is implemented as a shared object, and wherein each of the at least one process protection managers is implemented as a shared object.

[0029] In one embodiment, the parameter comparison and signal generation of the loaded process protection manager is in response to a control flow instruction associated with the respective protection module. In another embodiment, the control flow instruction associated with the respective protection module comprises a predetermined branch instruction to the process protection manager. In another embodiment, the parameter comparison and signal generation of the loaded process protection manager is further in response to information sent to the loaded process protection manager in response to the control flow instruction associated with the respective protection module.

[0030] In one embodiment, the control flow instruction in a first portion of the plurality of portions of the process comprises a branch or a call to an address associated with a second portion of the plurality of portions of the process, the comparison is with respect to an allowed flow model of a protection module associated with the second portion of the process. In another embodiment, the at least one protection module comprises a plurality of protection modules, and wherein, in response to the associated flow model not containing the respective parameter, the process protection manager is further arranged to: compare the one or more parameters of the control flow instruction with an allowed flow model of another protection module of the plurality of protection modules; and in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the respective allowed flow model, generate the predetermined signal.

[0031] In one embodiment, each of the plurality of portions of the process is associated with a respective file of the plurality of files, wherein the process protection manager loads the respective protection model shared object associated with a first file of the plurality of files in response to the first file exhibiting the predetermined indication, and wherein the process protection manager does not load the respective protection model shared object associated with a second file of the plurality of files in response to the second file not exhibiting the predetermined indication. In another embodiment, wherein the process protection manager is one of a plurality of process protection managers, each process protection manager exhibits a respective predetermined rule, the comparison is responsive to the respective predetermined rule of the respective process protection manager, and wherein the respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

[0032] In one embodiment, the process protection manager is one of a plurality of process protection managers, wherein the generated signal of a first process protection manager of the plurality of process protection managers is arranged to prevent operation of the respective control flow instruction, and the generated signal of a second process protection manager of the plurality of process protection managers is not arranged to prevent operation of the respective control flow instruction, and wherein the respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process. In another embodiment, a first portion of the plurality of portions of the process is associated with an executable file, and a second portion of the plurality of portions of the process is associated with a shared object file.

[0033] In one embodiment, the method further comprises loading the process protection manager into a plurality of processes. In another embodiment, at least the protection modules each exhibit an indication of which parameters are used in the respective comparison.

[0034] Additional features and advantages of the present application will be apparent from the detailed description, the drawings and the claims. BRIEF DESCRIPTION OF DRAWINGS

[0036] For a better understanding of the present application, and to show how it can be put into effect, reference will now be made, purely by way of example, to the accompanying drawings in which like numerals designate corresponding sections or elements in the various drawings.

[0037] With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of the preferred embodiments of the present application only and are presented in the cause of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the application. In this regard, no attempt is made to show structural details of the application in more detail than is necessary for a fundamental understanding of the application, the description taken with the drawings making apparent to those skilled in the art how the several forms of the application can be embodied in practice. In the drawings:

[0038] FIG. 1AA high level block diagram of a CFI protected shared object generation system is shown in accordance with certain embodiments;

[0039] FIG. 1B A high level flow diagram of a CFI protected shared object generation method is shown in accordance with certain embodiments;

[0040] FIGS. 1C-1E Various flow diagrams showing different examples of implementations of the method of FIG. 1B

[0041] FIG. 2A A high level block diagram of a CFI system is shown in accordance with certain embodiments;

[0042] FIG. 2B A high level block diagram of a process of a CFI system utilizing FIG. 2A

[0043] FIG. 2C A high level flow diagram of an operational method of a CFI system of FIG. 2A

[0044] FIGS. 3A-3B An example of a CFI system using FIG. 2A

[0045] Detailed description of preferred embodiments

[0046] Before one or more embodiments of the application are explained in detail, it is to be understood that the application is not limited in its application to the details of construction and the arrangement of the components set forth in the following description or illustrated in the drawings. The application is applicable to other embodiments or of being practiced or carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting.

[0047] FIG. 1A ​​​​A high-level block diagram of a CFI protected shared object generation system 10 is shown. The CFI protected shared object generation system 10 includes: a server 20; and a runtime unit 30. The runtime unit 30 is any system that runs using a call stack, such as, but not limited to, an electronic control unit of a vehicle. The server 20 includes: a processor 40; a memory 50; and a communication node 60. In one embodiment, the communication node 60 includes an Internet input / output port known to those skilled in the art. The runtime unit 30 includes: a processor 70; a memory 80; and a communication node 90 including one or more entry points and input handler pairs 95. Each entry point 95 is a hardware module that can be connected to an external device, such as, but not limited to, an Ethernet interface, a Controller Area Network (CAN) controller / transceiver, or a Bluetooth device. For each entry point 95, an input handler is provided, i.e., a software module that handles communication for the corresponding hardware entry point, such as, but not limited to, a CAN driver or an Ethernet driver.

[0048] FIG. 1B A high-level flowchart of a CFI-protected shared object generation method according to certain embodiments is shown. About FIG. 1A The CFI protection shared object generation system 10 is used to describe the CFI protection shared object generation method; however, this is not intended to limit it in any way, and the method can be performed by different appropriate systems without going beyond the scope.

[0049] In stage 1000, such as FIGS. 1C-1E As shown, one or more files are sent from user terminal 100 to server 20. In one embodiment, user terminal 100 includes runtime unit 30. In another embodiment, user terminal 100 communicates with runtime unit 30. In yet another embodiment, user terminal 100 communicates with a separate server (not shown) that communicates with multiple runtime units 30, the communication with the multiple runtime units 30 optionally being a temporary connection for the purpose of updating software. In one embodiment, as... FIG. 1C As shown, the ELF file is sent to server 20. In another embodiment, as... FIG. 1D As shown, the shared object file is sent to server 20. In another embodiment, both the ELF file and the shared object file are sent to server 20. Although FIGS. 1C-1E This is illustrated in response to an embodiment combining a single ELF file and / or a shared object file, but it is not intended to be limiting in any way. In another embodiment, multiple ELF files and / or multiple shared object files are sent to server 20. In one embodiment, each received ELF file is a binary program image.

[0050] In stage 1010, processor 40 of server 20 generates a protection module for each received file in response to instructions stored on memory 50. Each protection module is implemented as a shared object, i.e., a library that is compiled so that it can be shared by multiple applications, as is known to those skilled in the art. In one exemplary embodiment, the source code for each protection module is compiled using a GNU Compiler Collection (GCC) compiler with the -share flag. As will be described below, each protection module is loaded into a process at runtime. In one embodiment, a respective protection module is generated for each received ELF file. In another embodiment, respective protection modules are generated for multiple received ELF files. In one embodiment, a respective protection module is generated for each received shared object file. In another embodiment, respective protection modules are generated for multiple received shared object files. Each generated protection module includes an allowed flow model for the respective associated ELF or shared object file. In one embodiment, the allowed flow model is a model of deterministic allowed flow. The term “deterministic allowed flow” refers to a flow in which the allowed parameters of the flow have 100% certainty. For example, if the allowed return addresses from a particular function do not have 100% certainty, then the function is marked as non-deterministic.

[0051] In one embodiment, the allowed flow model is generated as described in PCT Patent Application Publication WO 2020 / 012,474, published January 16, 2020, the entire contents of which are incorporated herein by reference. Specifically, the respective allowed flow model includes one or more parameters for verifying the flow of a process. For example, the flow of a process can be a jump to a procedure and a return from a procedure. Thus, the flow will be verified at the jump to the procedure and at the return from the procedure. In one embodiment, the respective allowed flow model includes information regarding: a legal call stack that is allowed to jump to each of a plurality of addresses; legal return addresses; and legal registers to be used in association with respective opcodes in the associated received file. In another embodiment, the respective allowed flow model further includes information regarding legal buffer sizes for respective calls in the associated received file. In another embodiment, the respective allowed flow model further includes a legal flow for calling each of a plurality of functions. Specifically, the legal flow for calling a function is a chain of allowed functions sequences, where each function is allowed to call the next function in the chain.

[0052] In stage 1020, in one embodiment, each allowed flow model is generated by a first preparation script that scans the code of the respective file to determine: the legal call stack that is allowed to jump to each address; the legal return addresses; and the legal registers to be used. As mentioned above, in one embodiment, the first preparation script further scans the code of the respective file to determine the allowed buffer size for each function call. In another embodiment, the first preparation script further scans the code of the respective file to determine the legal flow for calling each of a plurality of functions. The respective allowed flow protection model thus indicates the legal values for the respective parameters. In one embodiment, the scanned code used to generate the allowed flow model is only the code associated with the system entry point of one or more input handlers 95 of the communication module 90 of the runtime unit 30.

[0053] In stage 1030, the processor 40 replaces at least one operation code of the respective received file with a predetermined instruction that will enter the respective generated protection module. In one embodiment, the first preparation script described above determines the call tree of the one or more input handlers 95 and replaces each operation code within the respective determined call tree with the respective predetermined instruction. Depending on the related architecture, the predetermined instruction can be a call to a protection function, a branch to a protection function or a jump to a protection function. For example, in the ARM instruction set, the operation code POP is replaced by BL xxxxx, where xxxxx is a relative offset from the current frame pointer to the address of the protection function. For cases where there are complex instruction sets where the return operation code can have different sizes, for example 16 bits or 32 bits, the return operation code is replaced by a call to a dedicated software interrupt of the pre-defined protection function. In one embodiment, each respective predetermined instruction includes a respective trampoline to the associated protection module.

[0054] Information about the replaced operation code is stored in the associated protection module. In particular, the location of the replaced operation code within the code is saved, allowing the protection module to know which operation code to execute if the call stack is valid, as will be described below. In addition, the location of the replaced operation code will allow the protection module to know which parameters should be analyzed. Furthermore, in one embodiment, the replaced operation code is copied into the protection module so that once authorized, the respective operation code can be executed, as will be described below.

[0055] In optional stage 1035, processor 40 further inserts an indication in the header of the adjusted file that the file has been adjusted. In stage 1040, processor 40 of server 20 further generates at least one process protection manager, each generated process protection manager being associated with a respective one of the received files of stage 1000. As described above with respect to the generated protection module of stage 1010, each generated process protection manager is implemented as a shared object. In one embodiment, as shown in FIG. 10B, a respective process protection manager is generated for a set of received files to be loaded into the same process. In another embodiment, a plurality of process protection managers are generated, each process protection manager being associated with a respective set of files to be loaded into a respective process. In another embodiment, a generated process protection manager is associated with files to be loaded into a plurality of processes, as will be described below. In one embodiment, each generated protection module of stage 1010 includes one or more instructions for branching to the process protection manager within the respective process, as will be described below. As will be further described below, each generated process protection manager is arranged to compare flows originating from the associated ELF file and shared object with the allowed flow model in the respective protection module. FIG. 1E

[0056] In optional stage 1045, processor 40 adds a dependency to the respective process protection manager to each adjusted ELF file. In stage 1050, communication module 60 of server 20 outputs to user terminal 100: the adjusted one or more files; and the generated one or more protection modules and process protection managers. In one example, as shown in FIG. 10C, server 20 receives a single ELF file represented as TEST.ELF. Server 20 replaces certain opcodes within TEST.ELF, as described above, the adjusted file being represented as TEST_PATCHED.ELF. As further described above, server 20 generates a respective protection module associated with TEST_PATCHED.ELF, the protection module being implemented as a shared object, the generated protection module being represented as TEST_PROTECTOR.SO. Additionally, as further described above, server 20 generates a respective process protection manager, the process protection manager being implemented as a shared object, the generated process protection manager being represented as PROTECTOR_PW.SO. Server 20 sends TEST_PATCHED.ELF, TEST_PROTECTOR.SO and PROTECTOR_PW.SO to user terminal 100. FIG. 1C

[0057] In FIG. 1D ​​In another example, server 20 receives a single shared object file denoted as HELPER. SO. As described above, server 20 replaces certain opcodes within HELPER. SO, the adjusted file is denoted as HELPER PATCHED. ELF. As further described above, server 20 generates a corresponding protection module associated with HELPER PATCHED. ELF, the generated protection module is implemented as a shared object, the generated protection module is denoted as HELPER PROTECTOR. SO. In addition, as further described above, server 20 generates a corresponding process protection manager, the process protection manager is implemented as a shared object, the generated process protection manager is denoted as PROTECTOR PW. SO. Server 20 sends HELPER PATCHED. ELF, HELPER PROTECTOR. SO, and PROTECTOR PW. SO to user terminal 100.

[0058] In FIG. 1E In another example, server 20 receives both TEST. ELF and HELPER. SO. Server 20 then generates and outputs: TEST PATCHED. ELF; TEST PROTECTOR. SO; HELPER PATCHED. ELF; HELPER PROTECTOR. SO; and PROTECTOR PW. SO. As shown, a single process protection manager is generated for use in the corresponding processes in which TEST PATCHED. ELF, HELPER PATCHED. ELF, TEST PROTECTOR. SO, and HELPER PROTECTOR. SO are loaded. Thus, a user can decide which files to protect and need not generate a process protection manager that protects all files in a protection process.

[0059] FIG. 2A A high-level block diagram of a CFI system 200 is shown, in accordance with certain embodiments. CFI system 200 includes: a plurality of protection modules 210; and a process protection manager 220. As described above, each of the plurality of protection modules 210 and process protection manager 220 is implemented as a shared object. In addition, each of the plurality of protection modules 210 and process protection manager 220 is loaded into a process. Each protection module 210 includes a corresponding allowed flow model associated with at least one of a plurality of portions of a process. In one embodiment, the allowed flow model of each protection module 210 is stored as read-only data, and thus cannot be modified by an attacker. In another embodiment, all of the code of each protection module 210 is stored as read-only data.

[0060] FIG. 2BA high-level block diagram of a process's code's original files is shown, including: a dynamically linked ELF file 230; a plurality of shared objects 240; a protection module 210 and a process protection manager 220. Together, the process protection manager 220 and the protection module 210 are referred to as the process protection system 215. FIGS. 2A-2B The ELF file 230 is executed, and the shared objects 240, the protection module 210 and the process protection manager 220 are loaded into the process. Thus, each protection module 210 is associated with a corresponding portion of the process that originates from either the ELF file 230 or the shared objects 240, as described above. The ELF file 230, the shared objects 240, the protection module 210 and the process protection manager 220 are each stored in a corresponding region of memory 250. Additionally, the process is run by a processor 260 that is associated with the memory 250, i.e. the CFI system 200 is run by the processor 260.

[0061] FIG. 2C A high-level flowchart of a method of operation of the CFI system 200 is shown, in accordance with certain embodiments. In stage 2000, during execution of the ELF file 230, the process protection manager 220 is loaded into the process. In one preferred embodiment, the process protection manager 220 is loaded into the process before any other shared objects, such as the protection module 210. In embodiments where the ELF file 230 contains a dependency on the process protection manager 220, the process protection manager 220 is loaded automatically. In embodiments where the ELF file 230 does not contain a dependency on the process protection manager 220, the process protection manager 220 will not be loaded automatically. In one embodiment, the LD_PRELOAD command is set with the path to the process protection manager 220 as part of the dynamic link library (DLL) injection.

[0062] In one embodiment, a plurality of process protection managers 220 are provided, each process protection manager 220 exhibiting a respective predetermined comparison rule. In particular, as will be described below, the process protection manager 220 compares respective parameters of certain control flow instructions to respective allowed flow models. In one embodiment, the comparison is performed in accordance with the respective predetermined comparison rule. For example, in one embodiment, each predetermined comparison rule can indicate a level of certainty of the comparison. In particular, in one embodiment, certain allowed flow models are not 100% certain, and there can be instances where a parameter of a control flow instruction does not satisfy a respective parameter of an allowed flow model, however this is not necessarily an exception because the allowed flow model is correct for most, but not all, cases. Additionally, certain allowed flow models are 100% certain, and any control flow instruction that does not satisfy a respective parameter of an allowed flow model is considered an exception. Furthermore, in one embodiment there are multiple types of allowed flow models, each having a different level of certainty. The predetermined comparison rule of the respective process protection manager 220 indicates what level of certainty to use for the current process, i.e., which allowed flow models to use.

[0063] In one embodiment, the respective process protection manager 220 is loaded in response to a predetermined characteristic of the process. In another embodiment, the predetermined characteristic of the process is the criticality of the process. For example, for critical processes, such as the braking system in a car, the process protection manager 220 that is loaded is one that exhibits a predetermined comparison rule that utilizes only allowed flow models that are 100% certain, because false positive exception detection is not acceptable in such critical processes. For less critical processes, the process protection manager 200 that is loaded is one that exhibits a predetermined comparison rule that utilizes allowed flow models that are less than 100% certain, thereby allowing false positives but reducing the number of false negatives.

[0064] In one example, ISO 26262“Road vehicles - Functional safety” is an international standard for functional safety of electrical and / or electronic systems in production automobiles defined by the International Organization for Standardization (ISO) in 2011. According to this standard, there are different safety levels:

[0065] 1. QM - Quality Management - no safety requirements; and

[0066] 2. ASIL A-D: Safety Integrity Levels, where ASIL D is the maximum level.

[0067] Thus, as described above, for different safety levels, different process protection managers 220 are used.

[0068] In one embodiment, a plurality of process protection managers 220 are provided, each process protection manager 220 generating a different predetermined signal. Specifically, as will be described below, in response to detection of an exception, i.e., when a corresponding parameter of a control flow instruction does not satisfy a corresponding parameter of an associated permitted flow model, a corresponding process protection manager 220 loaded into a process generates a predetermined signal. As will be further described below, in one embodiment, the generated predetermined signal includes an exception notification. In another embodiment, the generated predetermined signal alternatively or additionally includes an indication of whether the corresponding control flow instruction can be executed. In another embodiment, as described above, in response to a predetermined characteristic of a process, optionally in response to a criticality of a process, a corresponding process protection manager 220 is loaded. For example, for a critical process, the loaded process protection manager 220 is one that generates a predetermined signal that does not exhibit an indication of whether the control flow instruction can be executed. Since it is a critical process, an exception report is generated, but the CFI system 200 does not take action on the exception report so as not to inadvertently cause a fault in the critical process. For a less critical process, the loaded process protection manager 220 is one that generates a predetermined signal that exhibits an indication of whether the control flow instruction can be executed.

[0069] In stage 2010, protection modules 210 are loaded into the process. In one embodiment, the process protection manager 220 determines which protection modules 210 need to be loaded into the process. In particular, as described above, each protection module 210 is a shared object. Thus, it is not necessary to provide a unique protection module 210 for each file, and a single protection module 210 can be associated with multiple ELF files 230 or shared object files 240. The protection modules 210 analyze the executed ELF files 230 and shared object files 240 loaded into the process to identify whether the corresponding files exhibit a predetermined indication. As described above, in one embodiment, any patched file, i.e., a file in which an opcode is replaced, exhibits such an indication in a header of the corresponding file. For each file that exhibits a corresponding predetermined indication, the process protection manager 220 loads a corresponding protection module 210 associated with the corresponding file. In one embodiment, the corresponding protection module 210 is loaded using a DLOPEN command. For each file that does not exhibit a corresponding predetermined indication, the process protection manager 220 does not load a corresponding protection module 210 associated with the corresponding file.

[0070] In stage 2020, in response to a control flow instruction in one of the multiple portions of the process, the process protection manager 220 compares one or more parameters of the control flow instruction to the allowed flow model of the corresponding protection module 210 associated with the corresponding portion of the process. As described above, certain opcodes in each of the ELF file 230 and shared object 240 are replaced with predetermined instructions to enter the corresponding protection module 210, and thus in one embodiment the control flow instruction is an instruction to enter the corresponding protection module 210, as described above. As further described above, in another embodiment the corresponding protection module 210 contains an instruction to enter the process protection manager 220. Thus, the code segment replaced in stage 1030 above goes to the process protection manager 220 via the associated protection module 210. In other words, the comparison is performed in response to the corresponding control flow instruction in each process portion and the corresponding protection module 210. In another embodiment, the corresponding protection module 210 sends predetermined information to the process protection manager 220. In one embodiment, the predetermined information includes a pointer to a memory location that includes the corresponding allowed flow model. In another embodiment, the predetermined information includes the corresponding parameters of the allowed flow model for comparison. In one embodiment, as described above, the one or more parameters include: a call stack in use; a return address; a register in use; a buffer size; and / or a function flow.

[0071] In one embodiment, the corresponding protection module 210 exhibits a predetermined indication of which parameters the process protection manager 220 is to analyze. In another embodiment, the corresponding protection module 210 communicates the predetermined indication to the process protection manager 220. In another embodiment, the process protection manager 220 identifies the predetermined indication within the corresponding protection module 210. For example, if it is preferred for a particular shared object file 240 to accelerate CFI analysis, the corresponding protection module 210 exhibits an indication of a reduced number of parameters to analyze as compared to other protection modules 210. Thus, when using a single process protection manager, control flow in different shared object files 240 and / or ELF files 230 can be protected to different degrees depending on the preferred level of security and the amount of time that can be spent providing that level of security.

[0072] In optional stage 2030, if the control flow instruction in the first of the plurality of portions of the process includes a branch or a call to an address associated with a second of the plurality of portions of the process, the process protection manager 220 compares the corresponding parameter of the control flow instruction with the corresponding parameter of the allowed flow model associated with the second portion of the process. For example, if the ELF file 230 includes an instruction that branches to a function of the corresponding shared object file 240, the process protection manager 220 compares the corresponding parameter of the branch instruction with the corresponding parameter of the allowed flow model of the corresponding protection module 210 associated with the corresponding shared object file 240, as described above.

[0073] As further described above, in one embodiment, the process protection manager 220 is accessed via the corresponding protection module 210. Thus, in the case where the control flow instruction originating from the first file is a branch or a call to code originating from the second file, the allowed flow model used is not in the protection module 210 that connects the control flow instruction to the process protection manager 220. Thus, the process protection manager 220 will not know where to find the appropriate allowed flow model. Thus, in one embodiment, if the process protection manager 220 does not find the corresponding parameter associated with the corresponding control flow instruction originating from the first file in the allowed flow model of the protection module 210 to which it branches, the process protection manager 220 searches the other protection modules 210 loaded into the process to find the appropriate allowed flow model.

[0074] Advantageously, in the example of a pointer to a function, the pointer can be validated with expected values from other shared objects. For example, in an ARM-based system, where there is an instruction for "jump from register" and in the flow there is blx r3 in the ELF file 230, the process protection manager 220 checks that the pointer not only points to a known function in the ELF file 230, but also to a known function in all the protected shared objects 240.

[0075] In stage 2040, in response to the comparison result of stage 2020 indicating that the compared one or more parameters do not satisfy the corresponding parameters of the corresponding allowed flow model, the process protection manager 220 generates a predetermined signal. The term "do not satisfy the corresponding parameters" means herein that the corresponding parameters of the control flow instruction are not one of the allowed options in the allowed flow model. In one embodiment, the predetermined signal is a report indicating that the instruction does not satisfy the allowed flow model. In another embodiment, the predetermined signal prevents the operation of the corresponding flow instruction in the corresponding part of the process. In another embodiment, the process protection manager 220 further terminates the process. Preferably, as known by the person skilled in the art, a watchdog process will then restart the terminated process. In one embodiment, the operation is performed by the process protection manager 220 if the comparison indicates that the compared one or more parameters satisfy the corresponding parameters of the corresponding allowed flow model. In another embodiment, the operation is performed by the corresponding protection module 210 after receiving an approval from the process protection manager 220 if the comparison indicates that the compared one or more parameters satisfy the corresponding parameters of the corresponding allowed flow model. In one embodiment, as mentioned above, the type of the generated predetermined signal depends on the predetermined characteristics of the process.

[0076] Advantageously, as mentioned above, the protection modules 210 are shared objects, so they can be used by multiple shared object files. Thus, in case a shared object is used by more than one executable file, only a single protection module 210 is needed to protect this shared object. In contrast, if each executable file needs to contain information about the allowed flow model of a shared object, this allowed flow model, as well as any other information and functions stored in the protection module 210, would be duplicated for each executable file, consuming more disk space.

[0077] In addition, as mentioned above, different process protection managers 220 can be selected depending on the type of the process. Moreover, since the protection modules 210 and the process protection managers 220 are shared objects, they can be updated without having to update the entire executable file. This is very advantageous in the automotive industry where performing updates is very complex.

[0078] Further advantageously, by performing the comparison with the allowed flow model stored as read-only data, an attacker cannot modify this model to overcome the protection. This is in contrast with prior art solutions using magic cookies, stack canaries, shadow stacks, etc. that can be modified.

[0079] FIGS. 3A-3B An example of the use of the CFI system 200 is illustrated. In particular, FIG. 3A A memory 300 is illustrated, FIG. 3BA processor 310 associated with the memory 300 is shown. The memory 300 includes: a first ELF file 320; a patched version 325 of the ELF file 320, as described above; a protection module 210A associated with the patched ELF file 325; a second ELF file 330; a patched version 335 of the ELF file 330, as described above; a protection module 210B associated with the patched ELF file 335; a shared object file 340; a patched version 345 of the shared object file 340, as described above; a protection module 210C associated with the patched shared object file 345; a first process protection manager 220A; a second process protection manager 220B; and a third process protection manager 220C.

[0080] FIG. 3B The processor 310 shown in FIG. 3 runs four different processes: 350A; 350B; 350C; and 350D. Each process 350 is shown with the original file for each portion of the respective process 350. Specifically, a first portion of the process 350A is derived from the patched ELF file 325, a second portion of the process 350A is derived from the patched shared object file 345, a third portion of the process 350A is derived from the protection module 210A, a fourth portion of the process 350A is derived from the protection module 210C, and a fifth portion of the process 350A is derived from the process protection manager 220A.

[0081] A first portion of the process 350B is derived from the patched ELF file 335, a second portion of the process 350B is derived from the patched shared object file 345, a third portion of the process 350B is derived from the protection module 210B, a fourth portion of the process 350B is derived from the protection module 210B, and a fifth portion of the process 350B is derived from the process protection manager 220B.

[0082] A first portion of the process 350C is derived from the ELF file 320, a second portion of the process 350C is derived from the patched shared object file 345, a third portion of the process 350C is derived from the protection module 210C, and a fourth portion of the process 350C is derived from the process protection manager 220C.

[0083] A first portion of the process 350D is derived from the ELF file 330, a second portion of the process 350D is derived from the patched shared object file 345, a third portion of the process 350D is derived from the protection module 210C, and a fourth portion of the process 350D is derived from the process protection manager 220C.

[0084] In one example, in process 350A, the user wants to apply deterministic protection with zero level of false positive detection only. Thus, the user configures process protection manager 220A to have only deterministic security checks, e.g., verifying that a jump in the flow is to the beginning of a function. Additionally, in case of anomaly detection, process protection manager 220A performs only reporting of the anomaly. In contrast, process 350B has risky functionality, e.g., receiving a packet from a socket and parsing it. In this case, the user wants to apply all security features to prevent any false negatives. Thus, the user configures process protection manager 220B to have multiple security checks such as heap protection, process isolation, etc. Additionally, in case of anomaly detection, process protection manager 220B performs reporting and mitigation, i.e., blocking execution of the operation and / or terminating the process. In embodiments where the process is terminated, a watchdog process then restarts the terminated process as known to those skilled in the art.

[0085] As shown in processes 350C and 350D, the user can choose to protect only the shared library, i.e., patched shared object file 345, e.g., if the shared library is provided by a third party. Thus, the user executes unpatched ELF files 320 and 330, which are not protected at runtime. Additionally, process protection manager 320C, which is a shared object, is loaded into both processes. For each process, process protection manager 320C is loaded as LD_PRELAOD, thus it will see that patched shared object file 345 is loaded and it will increase the security by loading protection module 210C.

[0086] The above examples show the flexibility of CFI system 200 in controlling what to protect; how to protect; and what to do in case of anomaly detection.

[0087] The above has been described with respect to an embodiment in which the opcodes in the ELF files and shared object files are replaced with instructions to enter the corresponding protection module, however this is not meant to be limiting in any way. In another embodiment, instead of replacing the opcodes, code is added to each file to call the corresponding protection module in order to check the validity of the operation.

[0088] It will be appreciated that certain features of the application, which are, for clarity, described in the context of separate embodiments, can also be provided in combination in a single embodiment. Conversely, various features of the application, which are, for brevity, described in the context of a single embodiment, can also be provided separately or in any suitable

[0089] Unless specifically defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. Although methods similar or equivalent to those described herein can be used in the practice or testing of the present application, suitable methods are described herein.

[0090] All publications, patent applications, patents and other references mentioned herein are incorporated by reference in their entirety. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and not intended to be limiting.

[0091] One skilled in the art will recognize that the application is not limited to the specifics of what has been specifically shown and described herein. Rather, the scope of the present application is defined by the appended claims and includes both combinations and subcombinations of the various features described herein, as well as variations and modifications thereof, which would occur to persons of ordinary skill in the art upon reading the foregoing description.

Claims

1. A control flow integrity (CFI) system, comprising: at least one protection module, each of the at least one protection module comprising a respective allowed flow model associated with at least one of a plurality of parts of a process, wherein the allowed flow model is for a respective ELF file or shared object file that calls the at least one protection module; and at least one process protection manager, wherein the at least one protection module and respective process protection manager are loaded into the process, wherein a control flow instruction in one of the plurality of parts of the process enters an associated protection module, the associated protection module comprising an instruction to enter a respective process protection manager in the at least one process protection manager, wherein, in response to the control flow instruction, the associated protection module sends predetermined information to the respective process protection manager in the at least one process protection manager, the predetermined information comprising parameters of the allowed flow model contained in the associated protection module, wherein the respective process protection manager in the at least one process protection manager is arranged to, in response to the sent predetermined information: compare one or more parameters of the control flow instruction with the allowed flow model of the associated protection module; and generate a predetermined signal in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the allowed flow model, wherein each of the at least one protection module is implemented as a shared object, and wherein each of the at least one process protection manager is implemented as a shared object.

2. The system of claim 1, wherein, The instruction to enter the respective process protection manager in the at least one process protection manager comprises a predetermined branch instruction to the respective process protection manager in the at least one process protection manager.

3. The system of claim 1, wherein, The control flow instruction in a first part of the plurality of parts of the process comprises a branch or call to an address associated with a second part of the plurality of parts of the process, the comparison being with an allowed flow model of a protection module associated with the second part of the process.

4. The system of claim 1, wherein, The at least one protection module comprises a plurality of protection modules, and wherein, in response to the allowed flow model not containing the respective parameter, the respective process protection manager is further arranged to: compare the one or more parameters of the control flow instruction with an allowed flow model of another protection module of the plurality of protection modules; and generate the predetermined signal in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the allowed flow model.

5. The system of claim 1, wherein, Each of the plurality of parts of the process is associated with a respective file of a plurality of files, wherein, in response to a first file of the plurality of files exhibiting a predetermined indication, the respective process protection manager loads a respective protection model shared object associated with the first file, and wherein, in response to a second file of the plurality of files exhibiting a predetermined indication, the respective process protection manager loads a respective protection model shared object associated with the second file. wherein, in response to a second file of the plurality of files not exhibiting a predetermined indication, the respective process protection manager does not load a respective protection model shared object associated with the second file.

6. The system of claim 1, wherein, the at least one process protection manager comprises a plurality of process protection managers, each process protection manager exhibiting respective predetermined rules, the comparison is responsive to the respective predetermined rules of the respective process protection manager, and wherein the respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

7. The system of claim 1, wherein, the at least one process protection manager comprises a plurality of process protection managers, wherein a generated signal of a first process protection manager of the plurality of process protection managers is arranged to prevent operation of a respective control flow instruction, and a generated signal of a second process protection manager of the plurality of process protection managers is not arranged to prevent operation of a respective control flow instruction, and wherein the respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

8. The system of claim 1, wherein, a first portion of the plurality of portions of the process is associated with an executable file, and a second portion of the plurality of portions of the process is associated with a shared object file.

9. The system of claim 1, wherein, the respective process protection manager is loaded into a plurality of processes.

10. The system of claim 1, wherein, each of the at least one protection module exhibits an indication of which of the parameters are used in a respective comparison.

11. A control flow integrity (CFI) method, the method comprising: loading at least one protection module into a process, wherein the at least one protection module comprises an allowed flow model for a respective ELF file or shared object file, the respective ELF file or shared object file invoking the at least one protection module; and loading a process protection manager into the process, wherein a control flow instruction in one of a plurality of portions of the process enters an associated protection module, the associated protection module comprising an instruction to enter the process protection manager, wherein, in response to the control flow instruction, the associated protection module sends predetermined information to the process protection manager, the predetermined information comprising parameters of an allowed flow model contained in the associated protection module, wherein the loaded process protection manager is arranged to, in response to the sent predetermined information: compare one or more parameters of the control flow instruction to the allowed flow model of the associated protection module; and in response to a result of the comparison indicating that the compared one or more parameters do not satisfy a respective parameter of the allowed flow model, generate a predetermined signal, wherein each of the at least one protection module is implemented as a shared object, and wherein the process protection manager is implemented as a shared object.

12. The method of claim 11, wherein, the control flow instruction in a first portion of a plurality of portions of the process comprises a branch or call to an address associated with a second portion of the plurality of portions of the process, the comparison being with an allowed flow model of a protection module associated with the second portion of the process.

13. The method of claim 11, wherein, The at least one protection module comprises a plurality of protection modules, and wherein, in response to the allowed flow model not containing the respective parameter, the process protection manager is further arranged to: compare one or more parameters of the control flow instruction with an allowed flow model of another protection module of the plurality of protection modules; and generate the predetermined signal in response to a result of the comparison indicating that the one or more parameters of the comparison do not satisfy a respective parameter of the allowed flow model.

14. The method of claim 11, wherein, each of the plurality of portions of the process is associated with a respective file of a plurality of files, wherein, in response to a first file of the plurality of files exhibiting a predetermined indication, the process protection manager loads a respective protection model shared object associated with the first file, and wherein, in response to a second file of the plurality of files not exhibiting a predetermined indication, the process protection manager does not load a respective protection model shared object associated with the second file.

15. The method of claim 11, wherein, the process protection manager is one of a plurality of process protection managers, each process protection manager exhibiting a respective predetermined rule, the comparison is in response to the respective predetermined rule of the respective process protection manager, and wherein the respective process protection manager of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

16. The method of claim 11, wherein, the process protection manager is one of a plurality of process protection managers, wherein the generated signal of a first process protection manager of the plurality of process protection managers is arranged to prevent operation of a respective control flow instruction, while the generated signal of a second process protection manager of the plurality of process protection managers is not arranged to prevent operation of a respective control flow instruction, and wherein the respective one of the plurality of process protection managers is selected in response to a predetermined characteristic of the process.

17. The method of claim 11, wherein, a first portion of the plurality of portions of the process is associated with an executable file, and a second portion of the plurality of portions of the process is associated with a shared object file.

18. The method of claim 11, further comprising loading the process protection manager into a plurality of processes.

19. The method of claim 11, wherein, each of the at least one protection module exhibits an indication of which of the parameters are used in a respective comparison. each of the at least one protection module exhibits an indication of which of the parameters are used in a respective comparison.

Images