Method and system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS

Abstract

The present invention discloses a method and system for resisting return-oriented programming attacks based on zero-latency dynamic deep RAS, belonging to the field of computer technology. The method comprises: sending a control signal according to the type of the instruction to be submitted in the reorder buffer; when the type of the instruction to be submitted is a call instruction, pushing the return address included in the instruction to be submitted in the reorder buffer; when the type of the instruction to be submitted is a return instruction, performing a pop operation and providing a popped return address, comparing the popped return address with the return address included in the instruction to be submitted in the reorder buffer; and determining whether the instruction to be submitted has a risk of return-oriented programming attacks based on the comparison result. The present invention can resist return-oriented programming attacks without reducing processor performance.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a method and system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS. Background Art

[0002] In today's digital age, software security has become a key concern for businesses and individual users. As cyberattack methods continue to evolve, a type of attack known as Return-Oriented Programming (ROP) is increasingly gaining industry attention. ROP attacks cleverly manipulate the normal control flow of a program, allowing attackers to execute pre-existing code fragments in the target program without writing any malicious code. ROP attacks are an advanced memory attack technique that allows attackers to execute code despite the presence of security defenses. They typically force a buffer overflow, overwriting the return address on the program stack and causing program execution to jump to a carefully constructed ROP chain. The core principle of ROP attacks is to exploit existing instruction sequences within a program. Attackers carefully select and execute these execution sequences to achieve specific functions, such as executing scripts or escalating privileges. Because ROP attacks exploit the program's own code, they can bypass certain security mechanisms.

[0003] Most existing methods for defending against ROP attacks are implemented at the software level. Common approaches include Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Integrity (CFI). DEP prevents malicious code from executing by marking certain memory areas as non-executable. Because this method prevents code from executing in prohibited data segments, it effectively prevents buffer overflow attacks. However, attackers can still bypass DEP by exploiting memory areas in non-execution-protected segments. ASLR randomizes the layout of code and data in memory at each program startup, making it more difficult for attackers to predict addresses. However, attackers can still leak memory layout information through various means, thereby bypassing ASLR. Control Flow Integrity aims to prevent attackers from altering the normal execution flow of a program through control flow hijacking attacks. It analyzes the program's control flow graph to ensure that the program's control flow conforms to its original control flow graph. During execution, it verifies whether the target of indirect branch instructions is on a whitelist, and checks whether the identifiers at the entry and return points of software functions are consistent with expectations, thereby determining whether the software has been tampered with and thus preventing ROP attacks. However, the control flow integrity method is very complex to implement, and it is difficult to balance performance and security. Moreover, the control flow integrity method still has the possibility of being bypassed and causing failure.

[0004] In summary, since most of the existing methods for defending against ROP attacks are implemented using software technology, attackers may be able to bypass the protection set by the software, resulting in the failure of defense against ROP attacks. Summary of the Invention

[0005] In view of this, the present invention proposes a method and system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS, which effectively defends against ROP attacks through hardware to solve the technical problem that existing software methods for defending against ROP attacks are prone to failure.

[0006] In a first aspect, the present invention provides a method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS, the method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS comprising the following steps:

[0007] Sending a control signal according to the type of the instruction to be submitted in the reorder buffer;

[0008] When the type of the instruction to be submitted is a call instruction, a push operation is performed on the return address included in the instruction to be submitted in the reorder buffer according to the control signal;

[0009] When the type of the instruction to be submitted is a return instruction, a pop operation is performed according to the control signal, and a pop return address is provided, and the provided pop return address is compared with the return address included in the instruction to be submitted in the reorder buffer according to the control signal;

[0010] If the provided pop return address is inconsistent with the return address included in the current instruction to be submitted in the reorder buffer, it indicates that the return address has been modified, and an exception handling request signal is generated to notify the reorder buffer that the current instruction to be submitted is at risk of return-oriented programming attack, and send an exception handling request to the operating system to process the instruction; if the provided pop return address is consistent with the return address included in the current instruction to be submitted in the reorder buffer, it indicates that the return address has not been modified, and the current instruction to be submitted is not at risk of return-oriented programming attack, and the reorder buffer is controlled to submit the current instruction.

[0011] Furthermore, in the above-mentioned method for resisting return-oriented programming attacks based on zero-latency dynamic depth RAS, the method also includes a step of dynamic depth adjustment of the return address stack, and the step of dynamic depth adjustment of the return address stack includes: after each push or pop operation is executed, according to the size of the data in the current return address stack and the transmission behavior threshold, the return address in the reorder buffer is sequentially read from the memory and written to the bottom of the return address stack, or the return address in the reorder buffer stored in the return address stack is sequentially stored in the memory starting from the bottom of the return address stack, wherein, if the amount of data in the return address stack reaches twice the transmission behavior threshold, the return address data between the bottom address of the return address stack and the transmission behavior threshold address are sequentially stored in the memory; if the amount of data in the return address stack does not reach the transmission behavior threshold, the return addresses of the number equal to the transmission behavior threshold are sequentially taken out from the memory and stored between the bottom address of the return address stack and the specified address, and the specified address is the difference between the bottom address and the transmission behavior threshold address.

[0012] Furthermore, in the above-mentioned method for defending against return-oriented programming attacks based on zero-delay dynamic depth RAS, the step of dynamically adjusting the depth of the return address stack includes:

[0013] After each push or pop operation, the difference between the top pointer and the bottom pointer of the return address stack is calculated to obtain the amount of data in the current return address stack.

[0014] If the difference is equal to twice the transmission behavior threshold, the return address data between the stack bottom pointer and the address of the stack bottom pointer plus the transmission behavior threshold are stored in memory in sequence, and the value of the stack bottom pointer is set to the sum of the stack bottom pointer value and the transmission behavior threshold;

[0015] If the difference is less than the transmission behavior threshold, the return address data of the number equal to the transmission behavior threshold are taken out from the memory in sequence and stored in the stack bottom pointer of the return address stack to the address of the stack bottom pointer minus the transmission behavior threshold, and the value of the stack bottom pointer is set to the difference between the value of the stack bottom pointer and the transmission behavior threshold.

[0016] Furthermore, in the above-mentioned method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS, the control signal is provided with three flags: a validity flag, a call flag, and a return flag;

[0017] If there is a call instruction among the instructions to be submitted in the reorder buffer, the type of the instruction to be submitted is determined to be a call instruction, the validity flag bit and the call flag bit of the control signal sent are set to valid, and after receiving the control signal, a push operation is performed to read the return address included in the instruction to be submitted from the reorder buffer table entry and write it to the top of the return address stack;

[0018] If there is a return instruction in the instructions to be committed in the reorder buffer, the type of the instruction to be committed is determined to be a return instruction, the validity flag bit and the return flag bit of the control signal sent are set to valid, and after receiving the control signal, a pop operation is performed, the return address is read from the top of the return address stack, and compared with the return address in the reorder buffer entry;

[0019] If the two return addresses from the reorder buffer table entry and the return address stack table entry are inconsistent, an exception handling request signal is generated to notify the reorder buffer that the instruction to be submitted has a risk of return-oriented programming attack, and an exception handling request is sent to the operating system to process the instruction.

[0020] In a second aspect, the present invention further provides a system for defending against return-oriented programming attacks based on a zero-delay dynamic deep RAS. The system is arranged between a reorder buffer and a memory and interacts with the reorder buffer and the memory, and includes: a global control unit, a return address comparison unit, and a zero-delay dynamic deep return address stack, wherein:

[0021] The global control unit sends a control signal according to the type of the instruction to be submitted in the reorder buffer;

[0022] When the type of the instruction to be submitted is a call instruction, the zero-latency dynamic depth return address stack pushes the return address included in the instruction to be submitted in the reorder buffer according to the control signal; when the type of the instruction to be submitted is a return instruction, the zero-latency dynamic depth return address stack pops the return address included in the instruction to be submitted according to the control signal and provides the popped return address to the return address comparison unit;

[0023] When the type of the instruction to be submitted is a return instruction, the return address comparison unit compares the popped return address provided by the zero-latency dynamic depth return address stack with the return address included in the instruction to be submitted in the reorder buffer according to the control signal. If the popped return address provided by the zero-latency dynamic depth return address stack is inconsistent with the return address included in the instruction to be submitted in the reorder buffer, the return address comparison unit generates an exception handling request signal to notify the reorder buffer and the global control unit that the instruction to be submitted has a risk of return-oriented programming attack, and the global control unit sends an exception handling request to the operating system to process the instruction.

[0024] Furthermore, in the above-mentioned system for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS, the zero-delay dynamic deep return address stack includes:

[0025] a return address stack, for storing return addresses in the reorder buffer;

[0026] a transmission control subunit, configured to control data transmission between the return address stack and the memory, and to sequentially read the return addresses in the reorder buffer from the memory according to the amount of data currently in the stack and write them to the bottom of the stack, or to sequentially store the return addresses in the reorder buffer stored in the stack into the memory starting from the bottom of the stack;

[0027] A data channel, used for transmitting data between the return address stack and the memory;

[0028] A threshold register is used to configure a transmission behavior threshold of the transmission control subunit, and the transmission behavior threshold is used to measure whether address data is transmitted between the return address stack and the memory.

[0029] Furthermore, in the above-mentioned system for resisting return-oriented programming attacks based on zero-delay dynamic deep RAS, the global control unit includes a type checking subunit and a control subunit, wherein the type checking subunit obtains the opcode of the instruction to be submitted from the reorder buffer, determines the type of the instruction to be submitted, and notifies the control subunit to issue a corresponding control signal. The control subunit issues a control signal and controls the behavior of the zero-delay dynamic deep return address stack and the return address comparison unit.

[0030] Furthermore, in the above-mentioned system for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS, the return address comparison unit includes:

[0031] An address comparison subunit, which obtains a return address from the reorder buffer and the zero-delay dynamic depth return address stack and performs a comparison operation;

[0032] The notification subunit receives the comparison result from the address comparison subunit, determines whether to notify the global control unit to send an exception handling request to the operating system, and controls whether the reorder buffer submits the current instruction.

[0033] Furthermore, in the above-mentioned system for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS, the control signal is provided with three flags: a validity flag, a call flag, and a return flag;

[0034] If there is a call instruction among the instructions to be submitted in the reorder buffer, it is determined that the type of the instruction to be submitted is a call instruction, and the control subunit is notified to send a corresponding control signal. The validity flag bit and the call flag bit of the control signal sent by the control subunit are set to valid and transmitted to the zero-delay dynamic depth return address stack and the return address comparison unit. After receiving the control signal, the zero-delay dynamic depth return address stack performs a push operation, reads the return address included in the instruction to be submitted from the reorder buffer table entry, and writes the return address to the top of the return address stack of the zero-delay dynamic depth return address stack;

[0035] If there is a return instruction in the current batch of instructions to be submitted in the reorder buffer, it is determined that the type of the current batch of instructions to be submitted is a return instruction, and the control subunit is notified to send a corresponding control signal. The validity flag bit and the return flag bit of the control signal sent by the control subunit are set to valid and transmitted to the zero-delay dynamic depth return address stack and the return address comparison unit. After receiving the control signal, the zero-delay dynamic depth return address stack performs a pop operation. After receiving the control signal, the return address comparison unit reads a return address from the top of the return address stack of the zero-delay dynamic depth return address stack and compares it with the return address in the reorder buffer table entry.

[0036] If the two return addresses from the reorder buffer table entry and the return address stack table entry are inconsistent, the notification sub-unit generates an exception handling request signal to notify the reorder buffer and the global control unit that the instruction to be submitted has a risk of return-oriented programming attack, and the global control unit sends an exception handling request to the operating system to process the instruction.

[0037] The method and system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS of the present invention have the following advantages and beneficial effects:

[0038] The present invention adds a system including a global control unit, a return address comparison unit and a zero-delay dynamic depth return address stack between a reorder buffer and a memory. The global control unit identifies the type of the instruction to be submitted and controls the behavior of the zero-delay dynamic depth return address stack and the return address comparison unit. When the instruction is a call instruction, the zero-delay dynamic depth return address stack pushes the return address in the instruction; when the instruction is a return instruction, the zero-delay dynamic depth return address stack pops the return address stored at the top of the stack. The return address comparison unit compares the return address data stored at the top of the stack with the return address of the instruction to be submitted in the reorder buffer to determine whether the return address of the call instruction has been tampered with. It is thereby determined whether the instruction to be submitted is subject to a return-oriented programming attack risk. If the return-oriented programming attack risk exists, the global control unit sends an exception handling request to the operating system to process the instruction. If the return-oriented programming attack risk does not exist, the global control unit controls the reorder buffer to submit the instruction.

[0039] The present invention abandons the existing method of using software technology to achieve resistance to return-oriented programming attacks, and solves the problem that attackers may bypass the protection set by software, thereby causing the resistance to return-oriented programming attacks to fail. In the method and system for resisting return-oriented programming attacks based on zero-delay dynamic deep RAS of the present invention, the behavior of the zero-delay dynamic deep return address stack and the return address comparison unit are controlled by a global control unit, and the return address push and pop operations, return address comparison, etc. do not require the participation of the processor, thereby achieving effective resistance to return-oriented programming attacks through hardware without reducing processor performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings described herein are used to provide a further understanding of the embodiments of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0041] Figure 1 A flowchart of a method for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS provided by an embodiment of the present invention;

[0042] Figure 2 A flowchart of a step of dynamically adjusting the depth of a return address stack in a method for defending against return-oriented programming attacks based on zero-delay dynamic depth RAS provided by an embodiment of the present invention;

[0043] Figure 3 A block diagram of a system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS provided by an embodiment of the present invention;

[0044] Figure 4A schematic diagram of the overall structure of a system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS provided by an embodiment of the present invention;

[0045] Figure 5 A block diagram of a specific implementation of a system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The technical solution provided by the present invention is further described below with reference to the accompanying drawings and examples. It should be understood that the system structure and business scenarios provided in the embodiments of the present invention are mainly for illustrating possible implementation methods of the technical solution of the present invention and should not be interpreted as the sole limitation of the technical solution of the present invention. It is known to those skilled in the art that with the evolution of the system structure and the emergence of new business scenarios, the technical solution provided by the present invention is also applicable to similar technical problems.

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. In the event of any inconsistency, the meanings herein described or derived from the contents described herein shall prevail. In addition, the terms used herein are for the purpose of describing the embodiments of the present invention only and are not intended to limit the present invention.

[0048] Figure 1 FIG. 1 shows a flow chart of a method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS provided by an embodiment of the present invention. Figure 1 As shown, the method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS includes the following steps:

[0049] Step S1: issuing a control signal according to the type of the instruction to be submitted in the reorder buffer.

[0050] In an embodiment of the present invention, a re-order buffer (ROB) stores a sequence of instructions to be executed, including all information submitted for each instruction, such as an index, an operation code (opcode), and return address data.

[0051] At the beginning of each beat, the opcode of the instruction to be submitted in the current beat in the reorder buffer is accessed, and the type of the instruction to be submitted in the current beat is determined based on the opcode, whether it is a call instruction or a return instruction. A control signal is issued according to the instruction type, and different behaviors are executed according to the control signal.

[0052] Step S2: When the type of the instruction to be submitted is a call instruction, a push operation is performed on the return address included in the instruction to be submitted in the reordering buffer according to the control signal.

[0053] Step S3: When the type of the instruction to be submitted is a return instruction, a pop operation is performed according to the control signal, and a pop return address is provided. The provided pop return address is compared with the return address included in the instruction to be submitted in the reordering buffer according to the control signal.

[0054] Step S4: If the provided pop return address is inconsistent with the return address included in the current instruction to be submitted in the reorder buffer, it indicates that the return address has been modified, and an exception handling request signal is generated to notify the reorder buffer that the current instruction to be submitted has a risk of return-oriented programming attack, and send an exception handling request to the operating system to process the instruction; if the provided pop return address is consistent with the return address included in the current instruction to be submitted in the reorder buffer, it indicates that the return address has not been modified, and the current instruction to be submitted does not have a risk of return-oriented programming attack, and the reorder buffer is controlled to submit the current instruction.

[0055] In the embodiment of the present invention, RAS stands for Return Address Stack.

[0056] Furthermore, to expand the size of the zero-delay dynamic depth return address stack space and reduce hardware resource consumption, an embodiment of the present invention provides a method for defending against return-oriented programming attacks based on a zero-delay dynamic depth RAS, further comprising a step of adjusting the dynamic depth of the return address stack. Specifically, the step of adjusting the dynamic depth of the return address stack includes: after each push or pop operation, based on the current data size in the return address stack and a transmission behavior threshold, sequentially reading the return addresses in the reorder buffer from the memory and writing them to the bottom of the return address stack, or sequentially storing the return addresses in the reorder buffer stored in the return address stack into the memory starting from the bottom of the return address stack.

[0057] Specifically, after each push or pop operation is performed, if the amount of data in the return address stack is large, for example, reaching twice the transmission behavior threshold, the return address data between the bottom address of the return address stack and the transmission behavior threshold address are sequentially stored in the memory, and the bottom address of the stack is modified. In other words, some address segments in the memory are used to store data that is temporarily not used in the return address stack, and when these data are needed, they are taken out from the memory and put into the return address stack, thereby reducing hardware resource consumption. When the amount of data in the return address stack does not reach the transmission behavior threshold, the return addresses equal to the transmission behavior threshold are sequentially taken out from the memory and stored between the bottom address of the return address stack and the specified address, and the bottom address of the stack is modified, wherein the specified address is the difference between the bottom address of the stack and the transmission behavior threshold address. Thus, by reading the return address data from the memory into the stack when the stack table entries are insufficient, the return address stack space is expanded, that is, the memory supports the depth expansion when the stack table entries are insufficient through the data channel. Therefore, the method for defending against return-oriented programming attacks based on zero-delay dynamic depth RAS provided by the embodiment of the present invention can realize dynamic depth adjustment of the return address stack, thereby completing the defense against return-oriented programming attacks in the case of ultra-deep function calls.

[0058] In the embodiment of the present invention, the transmission behavior threshold is configured by the user. Preferably, the transmission behavior threshold is configured to be less than half of the number of return address stack entries.

[0059] Figure 2 A flowchart of a step of dynamically adjusting the depth of a return address stack in a method for defending against return-oriented programming attacks based on zero-delay dynamic depth RAS provided by an embodiment of the present invention is shown as follows: Figure 2 As shown, the specific implementation process of dynamic depth adjustment of the return address stack is as follows:

[0060] After each push or pop operation, the difference between the top pointer and the bottom pointer of the return address stack is calculated, that is, the amount of stack content;

[0061] If the difference is equal to twice the transmission behavior threshold, that is, the amount of data in the return address stack reaches twice the transmission behavior threshold, then the return address data between the stack bottom pointer and the address of the stack bottom pointer plus the transmission behavior threshold, that is, the return address data between the stack bottom address and the transmission behavior threshold address, are stored in the memory in sequence, and the value of the stack bottom pointer is set to the sum of the stack bottom pointer value and the transmission behavior threshold, that is, stack bottom pointer = stack bottom pointer + transmission behavior threshold. Some address segments in the memory store data in the return address stack that is temporarily unused;

[0062] If the difference is less than the transmission behavior threshold, that is, the amount of data in the return address stack does not reach the transmission behavior threshold, then the return address data equal to the transmission behavior threshold is taken out from the memory in sequence and stored in the stack bottom pointer of the return address stack to the address of the stack bottom pointer minus the transmission behavior threshold, and the value of the stack bottom pointer is set to the difference between the stack bottom pointer value and the transmission behavior threshold, that is, stack bottom pointer = stack bottom pointer - transmission behavior threshold.

[0063] In the embodiment of the present invention, in the step of dynamically adjusting the depth of the return address stack, if a default occurs when comparing the difference value with the transmission behavior threshold, the operation is terminated.

[0064] Furthermore, in an embodiment of the present invention, the control signal provides three flags: a validity flag (valid), a call flag (isCall) and a return flag (isRet); when the validity flag signal is 1, it indicates that the signal transmitted this time is valid; when the call flag signal is 1, it indicates that this operation is a call instruction; when the return flag signal is 1, it indicates that this operation is a return instruction.

[0065] If there is a call instruction among the instructions to be submitted in the reorder buffer, the type of the instruction to be submitted is determined to be a call instruction, the validity flag bit and the call flag bit of the control signal sent are set to valid (set to 1), and after receiving the control signal, a push operation is performed, and the return address included in the instruction to be submitted in the reorder buffer table is read and written to the top of the return address stack;

[0066] If there is a return instruction among the instructions to be submitted in the reorder buffer, the type of the instruction to be submitted is determined to be a return instruction, and the validity flag bit and return flag bit of the control signal sent are set to valid (set to 1). After receiving the control signal, a pop operation is performed, and the return address is read from the top of the return address stack and compared with the return address in the reorder buffer table entry;

[0067] If the two return addresses from the reorder buffer table entry and the return address stack table entry are inconsistent, an exception handling request signal is generated to notify the reorder buffer that the instruction to be submitted has a risk of return-oriented programming attack, and an exception handling request is sent to the operating system to process the instruction.

[0068] like Figure 3-5As shown, in order to implement the above-mentioned method for resisting return-oriented programming attacks based on zero-delay dynamic depth RAS provided by an embodiment of the present invention, an embodiment of the present invention provides a system for resisting return-oriented programming attacks based on zero-delay dynamic depth RAS, which is arranged between a re-order buffer (ROB) and a memory and interacts with the re-order buffer and the memory, including a global control unit 101, a return address comparison unit 103 and a zero-delay dynamic depth return address stack 102; the global control unit 101 sends a control signal according to the type of the instruction to be submitted in the re-order buffer; when the type of the instruction to be submitted is a call instruction, the zero-delay dynamic depth return address stack 102 pushes the return address included in the instruction to be submitted in the re-order buffer according to the control signal; when the type of the instruction to be submitted is a return instruction, the zero-delay dynamic depth return address stack 102 performs a pop operation according to the control signal, and sends a return address to the return address comparison unit 103. 3 provides a popped return address; when the type of the instruction to be submitted is a return instruction, the return address comparison unit 103 compares the popped return address provided by the zero-latency dynamic depth return address stack 102 with the return address included in the instruction to be submitted in the reorder buffer according to the control signal. If the popped return address provided by the zero-latency dynamic depth return address stack 102 is inconsistent with the return address included in the instruction to be submitted in the reorder buffer, the return address comparison unit 103 generates an exception handling request signal to notify the reorder buffer and the global control unit 101 that the instruction to be submitted has a risk of return-oriented programming attack. The global control unit 101 sends an exception handling request to the operating system to process the instruction.

[0069] refer to Figure 5 In an embodiment of the present invention, the reorder buffer stores the instruction sequence to be executed, including all information for each instruction submission, such as the index, operation code, and return address data. The global control unit 101 includes a type checking subunit and a control subunit. The type checking subunit obtains the operation code of the instruction to be submitted from the reorder buffer, determines the type of the instruction to be submitted, and notifies the control subunit to issue a corresponding control signal. The control subunit issues a control signal and controls the behavior of the zero-delay dynamic depth return address stack 102 and the return address comparison unit 103. Both use the same control signal, which provides three flags: a validity flag, a call flag, and a return flag. When the validity flag signal is 1, it indicates that the signal transmitted this time is valid; when the call flag signal is 1, it indicates that this operation is a call instruction; when the return flag signal is 1, it indicates that this operation is a return instruction.

[0070] Specifically, at the beginning of each beat, the type checking subunit in the global control unit 101 accesses the opcode bit in the reorder buffer table entry. If it is found that there is a call instruction in the instruction to be submitted in the beat, the validity flag bit and the call flag bit of the control signal are set to valid (set to 1), and the return flag bit is set to invalid (set to 0), and are passed to the zero-delay dynamic depth return address stack 102 and the return address comparison unit 103. After receiving the control signal, the zero-delay dynamic depth return address stack 102 performs a push operation, reads the corresponding return address from the reorder buffer table entry and writes it to the top of the return address stack of the zero-delay dynamic depth return address stack 102; if it is found that there is a call instruction in the instruction to be submitted in the beat, the validity flag bit and the call flag bit of the control signal are set to valid (set to 1), and the return flag bit is set to invalid (set to 0). If a return instruction is sent, the validity flag and the return flag of the control signal are set to valid (set to 1), and the call flag is set to invalid (set to 0), and the signals are passed to the zero-delay dynamic depth return address stack 102 and the return address comparison unit 103. The zero-delay dynamic depth return address stack 102 performs a pop operation after receiving the control signal. The return address comparison unit 103 reads the return address from the top of the return address stack of the zero-delay dynamic depth return address stack 102 after receiving the control signal, and compares it with the return address in the reorder buffer table entry. If it is found that there is no call and return instruction in the instructions to be submitted, the validity flag signal is set to 0, and other units do not perform any action.

[0071] refer to Figure 5, the zero-delay dynamic depth return address stack 102 exchanges data with the reorder buffer and the return address comparison unit 103 according to the control signal transmitted by the global control unit 101. The zero-delay dynamic depth return address stack 102 includes a return address stack, a transmission control subunit, a threshold register and a data channel; the return address stack is a stack with N table entries, N can be 32, and has a stack top pointer and a stack bottom pointer, where the stack top pointer represents the current stack top address, and the stack bottom pointer represents the current stack bottom address. The return address stack stores the return address in the reorder buffer through the threshold register, that is, each table entry in the return address stack stores the return address after each call instruction is submitted, and provides the return address for the return address comparison unit 103 when it works; the transmission control The subunit is used to control the data transmission between the return address stack and the memory, specifically: according to the current amount of data in the return address stack, the return address in the reordering buffer is read from the memory in sequence and written to the bottom of the return address stack, or the return address in the reordering buffer stored in the return address stack is stored in sequence starting from the bottom of the return address stack into the memory; the data channel is used to transmit data between the return address stack and the memory; the threshold register is used to configure the transmission behavior threshold of the transmission control subunit, and the transmission behavior threshold is used to measure whether the address data is transmitted between the return address stack and the memory; the transmission behavior threshold is configured by the user through the threshold register. Preferably, the transmission behavior threshold is configured by the threshold register to be less than half of the number of return address stack table entries N (that is, the transmission behavior threshold <N / 2)。

[0072] When the processor executes a function call instruction (call), the zero-delay dynamic deep return address stack 102 performs a push operation, pushing the call instruction's return address to the top of the stack. When the processor executes a function return instruction (ret), the zero-delay dynamic deep return address stack 102 performs a pop operation, popping the return address from the top of the stack, and the program returns to this address to continue execution. Because function calls and returns typically occur in pairs, and the return address is determined at the time of the call, the characteristics of the zero-delay dynamic deep return address stack 102 can be used to determine whether the call instruction's return address has been modified, thereby defending against return-oriented programming attacks.

[0073] Preferably, each time the reorder buffer executes the commit behavior of a call instruction, the validity flag bit and the call flag bit of the control signal received by the zero-latency dynamic depth return address stack 102 from the global control unit 101 are 1, the return address of the call instruction is written into the table entry corresponding to the address of the stack top pointer, and the stack top pointer is incremented by 1. Each time the reorder buffer executes the commit behavior of a return instruction, the validity flag bit and the return flag bit of the control signal received by the zero-latency dynamic depth return address stack 102 from the global control unit 101 are 1, the content of the address table entry corresponding to the stack top pointer is read out and sent to the return address comparison unit 103, and the stack top pointer is decremented by 1.

[0074] The return address comparison unit 103 includes an address comparison subunit and a notification subunit. The address comparison subunit obtains and compares return addresses from the reorder buffer and the zero-delay dynamic depth return address stack 102, then transmits the comparison result to the notification subunit. Specifically, upon receiving a control signal from the global control unit 101, the address comparison subunit compares the two return addresses from the reorder buffer entry and the return address stack entry. Based on the result transmitted by the address comparison subunit, the notification subunit determines whether to notify the global control unit 101 to send an exception handling request to the operating system and controls whether the reorder buffer commits the current instruction. Specifically, if the two return addresses derived from the reorder buffer table entry and the return address stack table entry are consistent, the notification sub-unit notifies the reorder buffer and the global control unit 101 that the return instruction submitted this time is risk-free; if the two return addresses derived from the reorder buffer table entry and the return address stack table entry are inconsistent, it indicates that the return address has been modified, and the notification sub-unit generates an exception handling request signal, such as an exception signal, to notify the reorder buffer and the global control unit 101 that there is a risk in submitting this instruction, and the global control unit 101 sends an exception handling request to the operating system to process the instruction.

[0075] Furthermore, in an optional implementation of an embodiment of the present invention, the zero-delay dynamic depth return address stack 102 also includes a pointer calculation module, which is used to calculate the amount of data in the stack based on the stack top pointer and the stack bottom address, and calculate the pointer address read from the memory to the stack and the pointer address read from the stack to the memory during the data transmission process between the return address stack and the memory, so as to realize the address data interaction between the return address stack and the memory.

[0076] In summary, the present invention adds a system including a global control unit 101, a return address comparison unit 103, and a zero-delay dynamic depth return address stack 102 between the reorder buffer and the memory. The global control unit 101 identifies the type of the instruction to be submitted and controls the behavior of the zero-delay dynamic depth return address stack 102 and the return address comparison unit 103. When the instruction is a call instruction, the zero-delay dynamic depth return address stack 102 pushes the return address in the instruction. When the instruction is a return instruction, the zero-delay dynamic depth return address stack 102 pops the return address stored at the top of the stack. The return address comparison unit 103 compares the return address data stored at the top of the stack with the return address of the instruction to be submitted in the reorder buffer to determine whether the return address of the call instruction has been tampered with. It then determines whether the instruction to be submitted is at risk of a return-oriented programming attack. If the risk of a return-oriented programming attack is present, the global control unit 101 sends an exception handling request to the operating system to process the instruction. If the risk of a return-oriented programming attack is not present, the global control unit 101 controls the reorder buffer to submit the instruction.

[0077] The present invention abandons the existing method of using software technology to achieve resistance to return-oriented programming attacks, and solves the problem that attackers may bypass the protection set by software, thereby causing the resistance to return-oriented programming attacks to fail. In the method and system for resisting return-oriented programming attacks based on zero-delay dynamic deep RAS of the present invention, the behavior of the zero-delay dynamic deep return address stack 102 and the return address comparison unit 103 are controlled by the global control unit 101, and the return address push and pop operations, return address comparison, etc. do not require the participation of the processor, thereby achieving effective resistance to return-oriented programming attacks through hardware without reducing processor performance.

[0078] It should be noted that the embodiments described in the present invention are only some of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the above detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of the present invention.

[0079] The words "first, second, third, etc." or module A, module B, module C and the like in the specification and claims are used only to distinguish similar objects and do not represent a specific ordering of the objects. It is understood that the specific order or sequence can be interchanged where permitted so that the embodiments of the invention described herein can be implemented in an order other than that illustrated or described herein.

[0080] In the above description, the numbers representing the steps involved do not necessarily mean that the steps must be executed. Intermediate steps may also be included or replaced by other steps. If permitted, the order of the previous and next steps may be interchanged or executed simultaneously.

[0081] The term "comprising" as used in the specification and claims should not be construed as limiting to what is listed thereafter; it does not exclude other elements or steps. Thus, it should be interpreted as specifying the presence of the features, integers, steps, or components mentioned, but not excluding the presence or addition of one or more other features, integers, steps, or components, or groups thereof. Thus, the expression "a device comprising means A and B" should not be limited to a device consisting solely of components A and B.

[0082] The reference to "one embodiment" or "an embodiment" in this specification means that the specific features, structures, or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present invention. Therefore, the phrases "in one embodiment" or "in an embodiment" appearing throughout this specification do not necessarily refer to the same embodiment, but may refer to the same embodiment. In addition, in the various embodiments of the present invention, unless otherwise specified or there is a logical conflict, the terms and / or descriptions of different embodiments are consistent and can be referenced to each other. The technical features of different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0083] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, all of which fall within the scope of protection of the present invention.

Claims

1. A method for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS, characterized in that: The method for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS comprises the following steps: A global control unit, a return address comparison unit, and a zero-latency dynamic depth return address stack capable of interacting with the reorder buffer and the memory are provided between the reorder buffer and the memory; Using the global control unit to issue a control signal according to the type of the instruction to be submitted in the reorder buffer; When the type of the instruction to be submitted is a call instruction, a zero-latency dynamic depth return address stack is used to push the return address included in the instruction to be submitted in the reorder buffer according to the control signal; When the type of the instruction to be committed is a return instruction, a zero-latency dynamic depth return address stack is used to perform a pop operation according to a control signal, and a pop return address is provided, and a return address comparison unit is used to compare the provided pop return address with the return address included in the instruction to be committed in the reorder buffer according to the control signal; If the provided pop return address is inconsistent with the return address included in the current beat to be submitted instruction in the reorder buffer, it indicates that the return address has been modified, and the return address comparison unit is used to generate an exception handling request signal to notify the reorder buffer and the global control unit that the current beat to be submitted instruction has a risk of return-oriented programming attack, and the global control unit is used to send an exception handling request to the operating system to process the instruction; if the provided pop return address is consistent with the return address included in the current beat to be submitted instruction in the reorder buffer, it indicates that the return address has not been modified, and the current beat to be submitted instruction does not have a risk of return-oriented programming attack, and the global control unit is used to control the reorder buffer to submit the current beat instruction; The method further includes a step of dynamically adjusting the depth of the return address stack, which includes: after each push or pop operation is performed, according to the amount of data in the current return address stack and the transmission behavior threshold, the return addresses in the reorder buffer are sequentially read from the memory and written to the bottom of the return address stack, or the return addresses in the reorder buffer stored in the return address stack are sequentially stored in the memory starting from the bottom of the return address stack, wherein if the amount of data in the return address stack reaches twice the transmission behavior threshold, the return address data between the bottom address of the return address stack and the transmission behavior threshold address are sequentially stored in the memory; if the amount of data in the return address stack does not reach the transmission behavior threshold, the return addresses equal to the transmission behavior threshold are sequentially taken out from the memory and stored between the bottom address of the return address stack and a specified address, wherein the specified address is the difference between the bottom address and the transmission behavior threshold address; The step of dynamically adjusting the depth of the return address stack includes: After each push or pop operation, the difference between the top pointer and the bottom pointer of the return address stack is calculated to obtain the amount of data in the current return address stack. If the difference is equal to twice the transmission behavior threshold, the return address data between the stack bottom pointer and the address of the stack bottom pointer plus the transmission behavior threshold are stored in memory in sequence, and the value of the stack bottom pointer is set to the sum of the stack bottom pointer value and the transmission behavior threshold; If the difference is less than the transmission behavior threshold, the return address data of the number equal to the transmission behavior threshold are taken out from the memory in sequence and stored in the stack bottom pointer of the return address stack to the address of the stack bottom pointer minus the transmission behavior threshold, and the value of the stack bottom pointer is set to the difference between the value of the stack bottom pointer and the transmission behavior threshold.

2. The method for defending against return-oriented programming attacks based on zero-delay dynamic deep RAS according to claim 1, characterized in that: The control signal is provided with three flags: a validity flag, a call flag, and a return flag; If there is a call instruction among the instructions to be submitted in the reorder buffer, the type of the instruction to be submitted is determined to be a call instruction, the validity flag bit and the call flag bit of the control signal sent are set to valid, and after receiving the control signal, a push operation is performed to read the return address included in the instruction to be submitted from the reorder buffer table entry and write it to the top of the return address stack; If there is a return instruction in the instructions to be committed in the reorder buffer, the type of the instruction to be committed is determined to be a return instruction, the validity flag bit and the return flag bit of the control signal sent are set to valid, and after receiving the control signal, a pop operation is performed, the return address is read from the top of the return address stack, and compared with the return address in the reorder buffer entry; If the two return addresses from the reorder buffer table entry and the return address stack table entry are inconsistent, an exception handling request signal is generated to notify the reorder buffer that the instruction to be submitted has a risk of return-oriented programming attack, and an exception handling request is sent to the operating system to process the instruction.

3. A system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS, characterized in that: The system is arranged between a reorder buffer and a memory and interacts with the reorder buffer and the memory, and includes: a global control unit, a return address comparison unit, and a zero-latency dynamic depth return address stack, wherein: The global control unit sends a control signal according to the type of the instruction to be submitted in the reorder buffer; When the type of the instruction to be submitted is a call instruction, the zero-latency dynamic depth return address stack pushes the return address included in the instruction to be submitted in the reorder buffer according to the control signal; when the type of the instruction to be submitted is a return instruction, the zero-latency dynamic depth return address stack pops the return address included in the instruction to be submitted according to the control signal and provides the popped return address to the return address comparison unit; When the type of the instruction to be submitted is a return instruction, the return address comparison unit compares, according to the control signal, a popped return address provided by the zero-latency dynamic depth return address stack and a return address included in the instruction to be submitted in the reorder buffer; if the popped return address provided by the zero-latency dynamic depth return address stack is inconsistent with the return address included in the instruction to be submitted in the reorder buffer, the return address comparison unit generates an exception handling request signal to notify the reorder buffer and the global control unit that the instruction to be submitted has a risk of a return-oriented programming attack, and the global control unit sends an exception handling request to the operating system to process the instruction; The zero-latency dynamic deep return address stack includes: a return address stack, for storing return addresses in the reorder buffer; a transmission control subunit, configured to control data transmission between the return address stack and the memory, and to sequentially read the return addresses in the reorder buffer from the memory according to the amount of data currently in the stack and write them to the bottom of the stack, or to sequentially store the return addresses in the reorder buffer stored in the stack into the memory starting from the bottom of the stack; A data channel, used for transmitting data between the return address stack and the memory; A threshold register is used to configure a transmission behavior threshold of the transmission control subunit, and the transmission behavior threshold is used to measure whether address data is transmitted between the return address stack and the memory.

4. The system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS according to claim 3, characterized in that: The global control unit includes a type checking subunit and a control subunit, wherein the type checking subunit obtains the opcode of the instruction to be submitted from the reorder buffer, determines the type of the instruction to be submitted, and notifies the control subunit to issue a corresponding control signal. The control subunit issues the control signal and controls the behavior of the zero-delay dynamic depth return address stack and the return address comparison unit.

5. The system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS according to claim 4, characterized in that: The return address comparison unit includes: An address comparison subunit, which obtains a return address from the reorder buffer and the zero-delay dynamic depth return address stack and performs a comparison operation; The notification subunit receives the comparison result from the address comparison subunit, determines whether to notify the global control unit to send an exception handling request to the operating system, and controls whether the reorder buffer submits the current instruction.

6. The system for defending against return-oriented programming attacks based on zero-latency dynamic deep RAS according to claim 5, characterized in that: The control signal is provided with three flags: a validity flag, a call flag, and a return flag; If there is a call instruction among the instructions to be submitted in the reorder buffer, it is determined that the type of the instruction to be submitted is a call instruction, and the control subunit is notified to send a corresponding control signal. The validity flag bit and the call flag bit of the control signal sent by the control subunit are set to valid and transmitted to the zero-delay dynamic depth return address stack and the return address comparison unit. After receiving the control signal, the zero-delay dynamic depth return address stack performs a push operation, reads the return address included in the instruction to be submitted from the reorder buffer table entry, and writes the return address to the top of the return address stack of the zero-delay dynamic depth return address stack; If there is a return instruction in the current batch of instructions to be submitted in the reorder buffer, it is determined that the type of the current batch of instructions to be submitted is a return instruction, and the control subunit is notified to send a corresponding control signal. The validity flag bit and the return flag bit of the control signal sent by the control subunit are set to valid and transmitted to the zero-delay dynamic depth return address stack and the return address comparison unit. After receiving the control signal, the zero-delay dynamic depth return address stack performs a pop operation. After receiving the control signal, the return address comparison unit reads a return address from the top of the return address stack of the zero-delay dynamic depth return address stack and compares it with the return address in the reorder buffer table entry. If the two return addresses from the reorder buffer table entry and the return address stack table entry are inconsistent, the notification sub-unit generates an exception handling request signal to notify the reorder buffer and the global control unit that the instruction to be submitted has a risk of return-oriented programming attack, and the global control unit sends an exception handling request to the operating system to process the instruction.

Images