Buffer Overflow Trapping via Non-Backed Memory Honey Pot
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory management systems fail to effectively prevent buffer overflows, which can lead to system errors and crashes by allowing programs to access unauthorized memory regions, and often notify attackers of invalid virtual addresses, potentially allowing them to find valid ones.
Innovation Solution
Implementing a non-backed memory honey pot system that uses a translation table with strategically placed gaps to redirect unauthorized memory access to a controlled overflow memory area, where data is written and analyzed for potential malicious activity, while preventing execution and capturing state information for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory management systems are used, then programs can access memory addresses directly, but buffer overflow attacks can occur and attackers are alerted when invalid addresses are used
Solution Approach 1:
The patent introduces an intermediary layer (the memory manager with translation table) between the program and physical memory. When a program accesses a virtual address, the memory manager checks the translation table and redirects to overflow memory if needed, without the program knowing. This intermediary prevents direct harmful access while maintaining program functionality.
Solution Approach 2:
The patent segments memory access into two paths: normal memory access for valid addresses and overflow memory access for invalid addresses. The translation table creates gaps that segment the address space, directing overflow attempts to controlled regions rather than allowing direct access to unauthorized memory areas.
2Reliability
If invalid virtual addresses are returned to programs, then memory access errors are detected, but attackers are notified and can find valid addresses
Solution Approach 1:
The patent converts the harmful buffer overflow attempt into a beneficial security feature by redirecting it to overflow memory. What would normally be an error condition (accessing invalid address) is transformed into a controlled redirection that both prevents damage and collects attack information without alerting the attacker.
Solution Approach 2:
The patent changes the 'color' or nature of the error response. Instead of returning an invalid address error that alerts the attacker, the system makes the overflow memory appear as a valid destination, masking the real security issue while maintaining program execution flow.
3Productivity
If buffer overflow is allowed to access unauthorized memory, then program execution continues, but system errors and crashes occur
Solution Approach 1:
The patent sets up overflow memory regions in advance as cushioning zones that absorb buffer overflow attempts. These pre-prepared regions prevent unauthorized memory access from causing system errors, while the program continues executing without interruption.
Data Source
AI summary
Aspects of the invention include receiving, at an operating system executing on a processor, a write request from a program to write data to a memory. The write request includes a virtual memory address and the data. It is determined that the virtual memory address is not assigned to a physical memory address. Based on the determining, the unassigned virtual memory address is assigned to a physical memory address in an overflow memory. The data is written to the physical memory address in the overflow memory and an indication that the write data was successfully written is returned to the program. Future requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.