Deterministic Code Flow Integrity via Path Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current defenses against return-oriented programming (ROP) exploits, jump-oriented programming (JOP) exploits, and call-oriented programming (COP) exploits are inadequate, as they often rely on maintaining a shadow stack or inserting ENDBRANCH instructions, which may not provide comprehensive protection against code flow integrity violations.
Innovation Solution
A computing device is equipped with a static analyzer and an instrumentation manager that identify atomic code paths and potential gadgets, inserting marker instructions and control flow integrity evaluation instructions to verify the execution of valid code paths, ensuring deterministic protection against ROP, JOP, and COP attacks by comparing path hashes to expected values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow stack is maintained in parallel with legacy stack, then protection against ROP exploits is improved, but device complexity and memory overhead increase
Solution Approach 1:
The patent creates a shadow stack that copies and mirrors the legacy stack structure, maintaining parallel stack frames with corresponding return addresses. This copying mechanism enables verification of stack integrity without fundamentally changing the existing stack architecture, providing ROP protection while keeping the system relatively simple.
Solution Approach 2:
The shadow stack is segmented into distinct stack frames that correspond to legacy stack frames, with each frame containing verified return addresses. This segmentation allows the system to protect only the critical return address data without managing the entire stack structure, reducing complexity compared to a fully redundant system.
2Reliability
If ENDBRANCH instructions are inserted into binaries, then protection against indirect branch exploits is improved, but manufacturing complexity and code size increase
Solution Approach 1:
The system performs preliminary static analysis during the compilation or linking phase to identify all valid indirect branch targets and insert appropriate marker instructions (such as ENDBRANCH) into the binary code. This preliminary preparation enables the runtime system to verify branch targets against a pre-computed list of valid targets, providing protection without requiring complex runtime analysis.
3Reliability
If marker instructions are inserted in atomic code paths, then code flow integrity verification is improved, but productivity and execution speed decrease
Solution Approach 1:
The hash computation is performed continuously as the atomic code path executes, with each marker instruction contributing to the running hash value. This continuous computation approach avoids the need for separate verification passes, allowing the integrity check to proceed in parallel with normal execution and minimizing performance impact.
4Measurement precision
If path hash computation is performed for each atomic code path, then measurement precision of code flow verification is improved, but use of energy and computation time increase
Solution Approach 1:
Instead of computing full cryptographic hashes for each code path, the system uses a simplified hash computation that processes only the essential path identifiers (such as marker instruction addresses). This copied-down approach maintains verification precision by capturing the unique characteristics of each atomic code path while using less computationally intensive operations.
Data Source
AI summary
Technologies for code flow integrity protection include a static analyzer that identifies a potential gadget in an atomic code path of a protected code. A marker instruction is inserted after the potential gadget with a parameter that corresponds to an address of the marker instruction, a hash evaluator instruction is inserted after an exit point of the atomic code path with a parameter that corresponds to the address of the marker instruction, and a compare evaluator instruction and a hash check instruction are inserted after the hash evaluator instruction. A target computing device executes the protected code and updates a path hash as a function of the parameter of the marker instruction, determines an expected hash value as a function of the parameter of the hash evaluator instruction, and generates an exception if the path hash and the expected hash value do not match. Other embodiments are described and claimed.