Runtime Code Repair Probes Defend Against MMU Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing self-checking systems are vulnerable to the MMU Attack, which reroutes data and code fetches to different physical addresses, allowing hackers to execute modified code while the unmodified version is checked, making it impossible for anti-tampering systems to detect this configuration.
Innovation Solution
The method synchronizes data and code memory accesses by modifying the program to only execute correctly when both are routed to the same physical addresses, using repair targets and probes to replace incorrect code sections at runtime, ensuring that the program behaves incorrectly if the MMU Attack is attempted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If self-checking systems use data fetches to perform checksums on code, then code integrity can be verified, but the system becomes vulnerable to MMU attacks where modified code is executed while unmodified code is checked
Solution Approach 1:
The patent creates a copy of the code in a separate memory location that is used for execution while the original code remains for integrity checking. This separation ensures that the checksumming process always operates on the unmodified original code, preventing MMU attacks from succeeding.
Solution Approach 2:
The patent divides the code into two separate memory locations: one for execution and one for integrity verification. By segmenting the code storage, the system can independently manage the execution copy and the checking copy, ensuring that modifications to the execution copy do not affect the integrity verification process.
2Adaptability or versatility
If the program executes code from memory locations that may be modified, then execution flexibility is achieved, but detection of code tampering becomes impossible
Solution Approach 1:
The patent introduces an intermediary integrity checking mechanism that independently verifies the code before execution. This intermediary layer detects tampering by comparing the executed code against a known good version, making tamper detection possible even when code execution flexibility is maintained.
Solution Approach 2:
The patent implements a feedback mechanism where the integrity checking system continuously monitors and verifies the code execution process. When tampering is detected, the system provides feedback to halt execution or alert the user, enabling detection of code tampering while maintaining execution flexibility.
3Reliability
If repair probes are injected to replace incorrect code sections, then code correctness is restored, but the program complexity increases
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing the correct code sections before they are needed during execution. When code tampering is detected, the system can immediately replace the corrupted sections with the pre-prepared correct versions, restoring correctness without requiring complex runtime analysis.
Solution Approach 2:
The patent implements self-service by enabling the system to automatically detect and repair its own code tampering issues. The integrity checking mechanism identifies corrupted sections and triggers automatic replacement with correct versions, reducing the need for external intervention and simplifying the overall system architecture.
Data Source
AI summary
In a general aspect, a computer implemented method can include identifying, in a program code stored in computer memory, a location of a dynamic repair target code section for an assignment to a program variable, a value of which is known only at runtime. The method can also include modifying the program code at the identified location of the dynamic repair target code section to assign an immediate value different from a correct runtime value to the program variable. The method can further include inserting, into the program code in the computer memory, a dynamic repair probe code section that is executed before the dynamic repair target code and, at runtime, modifies the immediate value in the code to contain the correct runtime value when an attack has not occurred.