Call Path Dependent Authentication for Code Re-use Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in guarding against code re-use attacks, where attackers manipulate branch instructions to bypass security protections by reassembling legitimate code snippets, despite restrictions on writing executable code to memory.
Innovation Solution
The implementation of a call path identifier storage element that permutes with a function return address to generate an updated call path identifier, and uses this identifier as a modifier for authentication code generation and checking, ensuring that even if the same function is called through different routes, the authentication code can be tied to a specific program context, making it difficult for attackers to substitute data values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication code is generated using only source values, then authentication is simple and fast, but authentication codes can be reused across different call paths making the system vulnerable to code re-use attacks
Solution Approach 1:
The patent introduces a call path identifier as an intermediary element that mediates between the source values and the authentication code. This identifier is permuted with the function return address and used as a modifier in authentication code generation, thereby linking the authentication code to the specific call path without requiring complex structural changes to the authentication mechanism itself
Solution Approach 2:
The patent changes the parameters of authentication code generation by incorporating a modifier value that depends on the call path identifier. This modifier is permuted with the function return address, creating a dynamic parameter set that varies according to the call path, thus preventing code re-use attacks while maintaining the basic authentication structure
2Reliability
If the system checks authentication codes for every function call, then security is enhanced, but processing time and computational overhead increase
Solution Approach 1:
The patent performs preliminary permutation of the call path identifier with the function return address at the beginning of each function call. This preliminary action prepares the modified call path identifier that will be used throughout the function execution, allowing for efficient authentication code generation and checking without repeated complex computations
Solution Approach 2:
The authentication mechanism serves itself by using the call path identifier, which is automatically updated through permutation with the function return address, as the modifier for authentication code generation. This self-updating mechanism eliminates the need for external management of authentication parameters, reducing overhead while maintaining security
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A call path identifier is maintained which is permuted in response to a calling instruction for calling a target function, based on a function return address. The call path identifier is used as a modifier value for authentication code generating and checking instructions for generating and checking authentication codes associated with source values. In response to the authentication code checking instruction, if an expected authentication code mismatches a previously generated authentication code for a source value then an error handling response is triggered. This is useful for preventing attacks where address pointers which are valid in one part of the code are attempted to be reused in other parts of code.