Software Buffer Overrun Protection via Dynamic Offset Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Buffer overruns in software create vulnerabilities that can be exploited by hackers for malicious purposes, as memory offsets are predictable and repeatable, allowing for the insertion of Trojans and other malicious code.
Innovation Solution
Randomizing the offsets between memory locations at installation time rather than compilation time, using a compiler that labels jumps during compilation and assigns random ordering of code and data using a key, generating unique object codes for each installation, thereby making it difficult for hackers to exploit buffer overruns consistently across different machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory offsets are assigned at compilation time with fixed locations, then code execution is efficient and simple, but security against buffer overrun exploits is compromised due to predictable offsets
Solution Approach 1:
The patent applies dynamics by transitioning from static memory offset assignment at compilation time to dynamic assignment at runtime. The system uses a runtime linker to randomly assign memory offsets when the program is loaded, ensuring that the same program binary produces different memory layouts on different systems or even on the same system across different runs. This dynamic randomization prevents buffer overrun exploits while maintaining execution efficiency through just-in-time relocation.
Solution Approach 2:
The patent changes the parameter of memory offset values from fixed deterministic values to random values. By using a random number generator seeded with system-specific values (such as processor ID, memory address, or timestamp), the system generates unique memory offset assignments for each execution context. This parameter change ensures that even if one system is compromised, the exploit cannot be transferred to another system with different random offsets.
2Reliability
If randomization of memory offsets is implemented, then security against buffer overrun exploits is improved, but code execution complexity and overhead increase
Solution Approach 1:
The patent applies preliminary action by performing memory offset randomization during the program loading phase rather than during compilation or execution. The runtime linker pre-calculates all necessary offset adjustments and applies them before the main program logic executes. This ensures that the randomization overhead occurs only once during startup, not during every function call or memory access, thereby minimizing execution time loss while maintaining security benefits.
3Ease of operation
If fixed memory layout is used, then debugging and development are simplified, but security vulnerabilities exist due to predictable buffer overrun targets
Solution Approach 1:
The patent introduces an intermediary layer (the runtime linker and offset management system) that sits between the fixed program binary and the actual memory allocation. This intermediary performs the randomization and offset calculation, allowing developers to work with fixed source code and standard debugging tools while the security hardening occurs transparently at runtime. The intermediary maintains a mapping between logical addresses in the binary and physical memory addresses, enabling debugging without exposing the randomization to development tools.
Data Source
AI summary
A compiler transforms the source code into object code, but it will postpone the assignment of all of the machine language jumps until installed time. This can be performed by labeling the jumps during compiled time, similarly to how variables are labeled for later indexing by the debugger. At installation time, given a random key, the installer will take the jump labels and assign random ordering of the code and data using the key as a seed. The final effect is that the same source code can potentially generate an infinite number of object codes, with the exact same functionality of execution. The main difference, however, is that as more jump labels are included, less fixed offsets between buffers are available to the black hat.