Bitmap-Based Control Flow Integrity for Large-Scale Deployment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional control flow integrity (CFI) techniques are impractical for large-scale retail deployment due to performance costs, incompatibility with legacy environments, and overall effectiveness, leaving memory safety vulnerabilities unmitigated.
Innovation Solution
Implement instrumentation checks during source code compilation to verify the validity of control transfer targets using a bitmap maintained by a runtime, and emit metadata to identify valid targets, ensuring the integrity of control flow by terminating execution on invalid targets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional CFI instrumentation is implemented, then control flow integrity is enforced, but performance overhead increases and compatibility with legacy systems decreases
Solution Approach 1:
The patent extracts the CFI validation logic from the main execution path by implementing indirect calls through a thunk function. The actual integrity checking is performed separately in the thunk rather than inline, removing the burden from the critical path and reducing performance overhead while maintaining control flow integrity enforcement.
Solution Approach 2:
The patent introduces a thunk function as an intermediary between the indirect call instruction and the actual target function. This thunk acts as a mediator that performs the integrity validation (checking if the target address is in the allowed set) before transferring control, thereby enabling CFI enforcement without directly instrumenting every indirect call site.
2Reliability
If conventional CFI instrumentation is implemented, then control flow integrity is enforced, but compatibility with legacy environments deteriorates
Solution Approach 1:
The patent implements a universal CFI enforcement mechanism that works across different execution contexts and legacy environments. The thunk-based approach provides a standardized interface that can handle various types of indirect calls (function pointers, virtual tables, jump tables) uniformly, making the solution adaptable to legacy systems without requiring environment-specific modifications.
Solution Approach 2:
The patent segments the CFI enforcement into separate components: the thunk function for validation logic and the indirect call site for invocation. This segmentation allows the validation mechanism to be independently configured and applied selectively, enabling compatibility with legacy systems that may not require full CFI enforcement or have different validation requirements.
3Object-affected harmful factors
If comprehensive instrumentation is added to verify control transfer targets, then security against buffer overruns improves, but device complexity increases
Solution Approach 1:
The patent extracts the complex validation logic from the indirect call sites and consolidates it in a single thunk function. This extraction reduces instrumentation complexity at call sites while maintaining comprehensive security checks, as the thunk centralizes the integrity verification logic in one location rather than duplicating it across multiple instrumented sites.
Solution Approach 2:
The patent changes the parameter representation by maintaining a set of allowed target addresses (or their hashes) rather than implementing complex static analysis or runtime type information structures. This parameter transformation simplifies the validation logic to a straightforward membership test, reducing instrumentation complexity while effectively preventing buffer overrun vulnerabilities.
Data Source
AI summary
Various technologies described herein pertain to enforcing control flow integrity by adding instrumentation when source code is compiled or binary code is rewritten. An indirect call to a control transfer target (e.g., in the source code, in the binary code, etc.) can be identified. Moreover, the instrumentation can be inserted prior to the indirect call. The instrumentation can use a bit from a bitmap maintained by a runtime to verify whether the control transfer target is valid. When an executable image that includes the inserted instrumentation runs, execution can be terminated and/or other appropriate actions can be taken when the control transfer target is determined to be invalid; alternatively, execution can continue when the control transfer target is determined to be valid.