Control Flow Integrity System Using Tagged Binary Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Control Flow Integrity (CFI) systems face significant overhead and complexity in implementing security measures, requiring the generation of a Control Flow Graph (CFG) and reliance on prior knowledge of software code symbols, which limits their practicality and efficiency in protecting against hijacking attacks.
Innovation Solution
An improved CFI system that does not require the generation of a CFG, operates without prior knowledge of code symbols, and uses a white-list of legitimate transfer targets, implemented through recursive-to-linear code analysis and binary rewriting, allowing for static and dynamic instrumentation to validate indirect control transfers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional CFI systems use CFG generation and code symbol analysis to enforce control flow integrity, then security protection against hijacking attacks is improved, but system overhead and complexity increase significantly
Solution Approach 1:
The patent extracts and removes the CFG generation component from the CFI enforcement system. Instead of requiring full CFG construction and code symbol analysis, the system uses a simplified approach that directly instruments control transfer instructions with validation code that checks destination addresses against a pre-computed whitelist of valid targets, eliminating the need for complex CFG data structures and analysis pipelines
Solution Approach 2:
The patent segments the CFI enforcement into two distinct phases: (1) an offline phase that statically analyzes the binary to identify all valid control transfer destinations and generates a whitelist, and (2) an online phase that instruments control transfer instructions to validate destinations against the whitelist. This segmentation allows the complex analysis work to be done once offline, while the runtime overhead is minimized to simple address validation
2Measurement precision
If conventional CFI systems require prior knowledge of code symbols and CFG generation, then control flow validation accuracy is improved, but ease of implementation and widespread application is worsened
Solution Approach 1:
The patent performs preliminary static analysis offline to generate a whitelist of valid control transfer destinations before runtime enforcement begins. This pre-computation captures all necessary validation information in advance, allowing the runtime system to operate with simple address matching without requiring complex symbol tables or CFG structures during execution
Solution Approach 2:
The patent creates a simplified representation (whitelist) that copies only the essential validation information (valid destination addresses) from the full binary analysis, discarding unnecessary details like complete CFG structures and symbol metadata. This copied whitelist is sufficient for runtime validation and dramatically reduces implementation complexity
3Reliability
If CFI instrumentation is applied to all control transfer instructions with dynamic checks, then security coverage is improved, but runtime overhead increases by average 16%
Solution Approach 1:
The patent applies different validation strategies to different control transfer instructions based on their characteristics. For direct transfers to fixed destinations, no runtime check is needed. For indirect transfers, the system validates against the whitelist. This localized approach ensures security coverage where needed while minimizing overhead for transfers that don't require validation
4Reliability
If machine code rewriting is used to implement dynamic checks for computed control-flow transfers, then CFI enforcement capability is improved, but compatibility issues and implementation difficulty increase
Solution Approach 1:
The patent implements a universal CFI enforcement mechanism that works across different platforms and binary formats by using architecture-independent concepts (valid destination whitelists and address validation). The system can be applied to various instruction sets and binary formats without requiring platform-specific CFG generation tools or complex rewriting rules, making it broadly adaptable
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An improved CFI system and method is described that provides security from attacks to hijack computer software. The improved CFI system and method inserts two tags to execute label identification. The first tag is positioned before any instruction that would result in an indirect control flow transfer and requires the program to execute a check. The second tag is located before the first line of any legitimate transfer destination and when discovered by the tag check allows a program to carry out the indirect transfer. This tag orientation does not prevent transfers to targets other than the origin instruction's specific intended destination but limits transfers to destinations that begin with the proper label dedication. Although, an incorrect address may be called, that will be within the software program's assortment of legitimate indirect transfer targets. Attempts to exploit or reroute indirect transfers outside of the established control flow are eliminated.