Computing Device Address Probing Countermeasures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern defenses against code reuse attacks, such as information-hiding based on address space layout randomization, are vulnerable to probing attacks that can compromise security, leading to a dilemma between performance-heavy software integrity measures and inefficient information-hiding defenses.
Innovation Solution
A computing device and compiler method that randomizes addresses in an address space, monitors for address probing, and selectively replaces vulnerable code parts with hardened versions, transitioning from passive to active defenses under attack, thereby balancing performance and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software integrity measures (bounds-checking, control flow integrity, software fault isolation) are enforced to protect against code reuse attacks, then security against attacks is improved, but performance incurs significant slowdown (9% to 19.6% overhead)
Solution Approach 1:
The patent applies partial action by selectively enabling integrity checks only in code regions that are actually vulnerable to probing attacks, rather than enforcing them universally. The system dynamically identifies vulnerable regions and applies protection only where needed, reducing the overall performance overhead while maintaining security where it matters most.
Solution Approach 2:
The patent implements local quality by making the security protection non-uniform across the program. Different code regions receive different levels of protection based on their vulnerability assessment. The system dynamically adjusts the intensity of integrity checks in specific locations rather than applying a blanket approach, thereby optimizing the security-performance tradeoff.
2Productivity
If information-hiding defenses (address space layout randomization, hiding sensitive data in large address space) are used to protect against code reuse attacks, then performance overhead is reduced, but security is weakened due to vulnerability to probing attacks
Solution Approach 1:
The patent applies preliminary action by proactively monitoring for probing attacks and identifying vulnerable code regions before attackers can fully exploit them. The system continuously scans and assesses code regions, preparing protection measures in advance rather than reacting only after an attack is detected, thus maintaining both performance and security.
Solution Approach 2:
The patent implements dynamics by making the defense mechanism adaptive and changeable in response to detected threats. The system dynamically transitions from passive information-hiding to active integrity monitoring in specific code regions when probing attacks are detected, allowing it to optimize between performance and security based on real-time conditions.
3Productivity
If passive information-hiding defenses are used, then performance is maintained with low overhead, but the defenses are vulnerable to repeated probing attacks that can exhaust entropy and reveal sensitive data
Solution Approach 1:
The patent applies feedback by continuously monitoring for signs of probing attacks and using this information to dynamically adjust protection levels. The system detects probing patterns, feeds this information back into the protection mechanism, and responds by strengthening integrity checks in affected regions, creating a closed-loop defense that adapts to ongoing attacks.
Solution Approach 2:
The patent implements dynamics by enabling the defense system to transition from a static passive state to an active protective state in response to detected threats. The system dynamically adjusts its behavior based on real-time conditions, maintaining low overhead during normal operation but activating stronger protections when probing attacks are detected.
Data Source
AI summary
Some embodiments are directed to a computing device (100) configured for execution of a computer program protected against address probing. The device is configured to run at least one anomaly detector (140) for detecting an address probing on the computer program, and to selectively replace an originating computer program code part with a replacement computer program code part wherein an address probing countermeasure is added.