Authenticated Pointer Sandboxing for Dynamically Generated Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamically-generated execution code can exploit unprotected writable and executable memory regions, posing a risk of memory corruption attacks, which existing technologies like ARMv8.3 pointer authentication fail to adequately address.
Innovation Solution
Restrict dynamically generated code to a first memory region within an unprotected space, separate from other processes, using authenticated pointers and maintaining a separate processing stack, and enforce all memory access and control transfers through these authenticated pointers, disabling other pointer authentication instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pointer authentication is used to protect memory regions, then security against memory corruption attacks is improved, but dynamically generated code can still exploit unprotected writable and executable memory regions
Solution Approach 1:
The patent segments the memory space into protected and unprotected regions, and further segments the execution environment by creating a separate sandboxed execution context for dynamically generated code. This segmentation isolates the harmful code execution from the protected memory regions, preventing attacks while maintaining the benefits of pointer authentication.
Solution Approach 2:
The patent introduces a sandboxed execution environment as an intermediary layer between the dynamically generated code and the protected memory regions. This intermediary sandbox restricts the code's access to memory, allowing it to execute without directly compromising the protected regions, thus resolving the contradiction between enabling dynamic code generation and maintaining security.
2Adaptability or versatility
If dynamically generated code is allowed to execute in unprotected memory regions, then code generation flexibility is improved, but security is worsened due to potential memory corruption attacks
Solution Approach 1:
The patent creates a segmented execution model where dynamically generated code is confined to a separate sandboxed memory region. This segmentation allows the code to be generated and executed flexibly while preventing it from accessing or corrupting protected memory regions, thus maintaining both adaptability and security.
Solution Approach 2:
The patent applies local quality by providing different memory access permissions and security properties to different regions. The sandboxed region allows dynamic code execution with relaxed constraints, while protected regions maintain strict security, allowing each region to have optimized properties for its specific function.
3Reliability
If pointer authentication instructions are enabled for all memory access, then memory security is improved, but performance is worsened due to additional verification overhead
Solution Approach 1:
The patent applies local quality by enabling pointer authentication only where necessary. In the sandboxed execution environment, authentication is relaxed or disabled for dynamically generated code to improve performance, while maintaining security in protected memory regions where authentication remains enabled. This selective approach optimizes both security and performance.
Solution Approach 2:
The patent uses partial action by applying pointer authentication only to specific memory accesses that require it, rather than universally to all accesses. This selective authentication reduces the verification overhead for dynamically generated code while maintaining security for critical protected regions, thus improving overall performance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method is provided for safely executing dynamically generated code to avoid the possibility of an attack in unprotected memory space. Upon ascertaining that dynamically generated code is to be executed, a processing circuit and/or operating system kernel restrict the dynamically generated code to use a first memory region within an unprotected memory space, where the first memory region is distinct (e.g., reserved) from other memory regions used by other processes executed by the processing circuit. A first processing stack is maintained for the dynamically generated code within the first memory region. This first processing stack is separate from a general processing stack used by other processes executed by the processing circuit. A stack pointer is switched/pointed to the first processing stack when the dynamically generated code is executed and the stack pointer is switched/pointed to the general processing stack when the dynamically generated code ends.