Binary Return Address Tokenization for Control Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Control Flow Integrity (CFI) methods are complex and require significant overhead, making them unfeasible for widespread commercial application, and they necessitate rigorous implementation processes, which are not suitable for scenarios where source code modifications are not feasible or possible.
Innovation Solution
The method involves modifying a program binary by injecting code into a function to tokenize the return address of the function, improving the robustness against stack-based attacks without requiring source code access or altering the typical behavior of the electronic system, and does not necessitate the generation of a Control Flow Graph (CFG).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional CFI methods are used to protect against stack-based attacks, then security reliability is improved, but system complexity and implementation overhead increase significantly
Solution Approach 1:
The patent segments the return address into multiple parts: a base address and an offset. The base address is validated against a whitelist of valid function addresses, while the offset is used to calculate the actual return address. This segmentation simplifies the validation process compared to conventional CFI methods that require complex control flow graphs, reducing system complexity while maintaining security reliability.
Solution Approach 2:
The patent performs preliminary validation of the base address portion of the return address before the function returns. By checking if the base address belongs to a predefined set of valid functions and validating the offset format in advance, the system prevents malicious returns without requiring complex runtime control flow monitoring, thus reducing implementation overhead while improving security.
2Reliability
If conventional CFI methods are implemented with rigorous implementation processes, then control flow protection is improved, but ease of manufacture and deployment deteriorate
Solution Approach 1:
The patent extracts only the essential validation logic needed for control flow protection, separating it from the complex CFG generation and maintenance processes. By implementing a simplified validation mechanism that checks base addresses against a whitelist and validates offsets, the system achieves control flow protection without the rigorous implementation processes required by conventional CFI, improving ease of deployment.
Solution Approach 2:
The patent uses a lightweight validation approach that does not require expensive, complex data structures like full control flow graphs. Instead, it uses simple whitelists of valid base addresses and offset validation rules, which are much cheaper to implement and deploy. This disposable, simple validation mechanism provides sufficient protection without the deployment complexity of conventional CFI systems.
3Reliability
If source code modifications are made to implement CFI, then security enforcement is improved, but adaptability to scenarios without source code access deteriorates
Solution Approach 1:
The patent introduces an intermediary validation layer that operates between the function call and return instructions without requiring source code modifications. By injecting validation code that checks the return address format and validates it against a whitelist, the system enforces security in compiled binaries without accessing source code, thus improving adaptability to scenarios where source code is unavailable.
Solution Approach 2:
The patent changes the parameter validation approach from requiring source code-level annotations to validating runtime parameters (return addresses) against predefined criteria. By checking if the return address base belongs to a whitelist of valid functions and validating the offset parameter, the system achieves security enforcement in compiled binaries without source code access, improving adaptability.
Data Source
AI summary
Systems and methods of modifying a program binary by injecting code into a function of a program binary that tokenizes the return address of the function. The tokenization of the return address improves the robustness of the program binary against cyberattacks. For example, an attacker's attempt to hijack program flow before a function return will fail since any return address modified by the adversary will be tokenized (e.g., using a binary operation such as an XOR) resulting in an unusable address that will cause the system to crash. One advantage of the improved CFI consumes less average overhead and does not require all of the complications of the conventional CFI systems. In some embodiments, the tokenization includes applying a binary operation on a randomly-generated token and the return address. The token can be generated at transform time, load time, or run time.