Branch Identifier Registers for Control Flow Hijacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Control Flow Integrity (CFI) technologies face challenges in achieving high precision without incurring significant performance overhead, particularly in detecting control flow hijacking attacks, as they rely on software-only implementations and have limited precision when integrated into CPU architectures.
Innovation Solution
The introduction of multiple branch identifier registers and specific instructions, such as setBID and chkBID, which dynamically allocate and compare identifiers for branch targets, enabling precise detection of control flow hijacking attacks without excessive performance overhead by using a processor with these registers and instructions to write and verify identifiers in a predetermined sequence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software-only CFI implementation is used, then implementation simplicity is maintained, but CFI precision is low and performance overhead is large
Solution Approach 1:
The patent introduces branch identifier registers as intermediary hardware components that store identifiers of branch targets. These registers act as mediators between the processor execution units and the CFI checking mechanism, enabling efficient comparison of actual branch targets against expected targets without requiring complex software analysis, thus improving CFI precision while maintaining performance
Solution Approach 2:
The patent replaces the software-based CFI checking mechanism with hardware-based branch identifier registers and comparison logic integrated into the processor architecture. This substitution of mechanical/software system with hardware system eliminates the performance overhead associated with software interpretation and execution, while providing precise control flow validation
2Measurement precision
If CPU architecture extension for CFI is added, then CFI precision is improved, but device complexity increases
Solution Approach 1:
The branch identifier registers are designed to serve multiple functions: storing branch target identifiers for CFI checking, maintaining execution state information, and supporting efficient branch prediction. This multi-functionality reduces the need for dedicated separate components, thereby limiting the increase in device complexity while achieving improved CFI precision
Solution Approach 2:
The patent modifies processor architecture parameters by adding branch identifier registers with specific bit widths and comparison logic that match the identifier format. These parameter changes are minimal and integrated into existing register files and execution units, avoiding significant architectural complexity while enabling precise control flow validation
Data Source
AI summary
Disclosed herein are an apparatus and method for detecting violation of control flow integrity. The apparatus includes memory for storing a program and a processor for executing the program, wherein the processor multiple branch identifier registers to which identifiers of branch targets are written, a set branch identifier instruction configured to command an identifier of a branch target to be written to a branch identifier register at a predetermined sequence number, among the multiple branch identifier registers, and a check branch identifier instruction configured to command a signal indicating detection of a control flow hijacking attack to be issued based on whether a value written to the branch identifier register at the predetermined sequence number is identical to a value of an identifier of a branch target at the predetermined sequence number, wherein the program detects whether a control flow is hijacked based on the multiple branch identifier registers.