Call Stack Protection via Metadata Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Buffer overflow attacks exploit the shared memory stack frames of user and meta data in computer systems, allowing malicious applications to control program flow by overwriting return addresses, posing a significant threat to memory security.
Innovation Solution
Allocate separate memory pages as distinct stacks for meta data and user data for function calls, with a memory protection key generated for the meta data stack to prevent unauthorized access and protect critical metadata from overflow attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user data and meta data are stored in the same stack frame, then memory usage is efficient and simple, but the system becomes vulnerable to buffer overflow attacks that can overwrite return addresses and control program flow
Solution Approach 1:
The patent divides the traditional unified stack into separate stacks: a user data stack for storing user data and a meta data stack for storing meta data including return addresses. This segmentation isolates critical meta data from user data, preventing buffer overflow attacks from overwriting return addresses while maintaining efficient memory management through distinct stack structures.
2Reliability
If a memory protection key is generated for the meta data stack, then unauthorized access and buffer overflow attacks are prevented, but memory management complexity increases
Solution Approach 1:
The patent introduces a memory protection key as an intermediary mechanism that mediates access to the meta data stack. This protection key acts as a security layer between user data and critical meta data, allowing legitimate access while blocking malicious buffer overflow attacks. The protection key manages the complexity by providing a standardized interface for secure access without requiring complex validation logic throughout the system.
3Reliability
If separate memory pages are allocated for meta data and user data, then buffer overflow attacks are prevented through isolation, but memory overhead and allocation complexity increase
Solution Approach 1:
The patent allocates separate memory pages for user data and meta data, creating physically isolated stack structures. This segmentation ensures that even if user data buffer overflow occurs, the attack cannot reach or overwrite meta data including return addresses. The separate allocation is managed through systematic stack frame structures that reduce allocation complexity despite the increased memory organization requirements.
Data Source
AI summary
A first memory page in a memory of the computer is allocated as a first stack to buffer meta data for function calls in the program. A memory protection key for the first memory page is generated. A second memory page in the memory is allocated as a second stack to buffer user data for function calls in the program.