Control Flow Enforcement Unit for ROP Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are vulnerable to attacks like Return Oriented Programming (ROP) that divert or alter the program flow, compromising system integrity due to the inability to effectively enforce control flow integrity, especially in embedded controllers and other systems susceptible to manipulation or environmental factors.
Innovation Solution
A computer-implemented method and system for enforcing control flow integrity through analyzing a reference control flow to derive and evaluate control flow rules, using a rule checking component to detect deviations during execution, and generating responses to intervene when deviations occur, which can be implemented in hardware or virtual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software countermeasures are used to defend against ROP attacks, then system security is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent replaces complex software-based control flow enforcement mechanisms with a hardware-based solution. The control flow enforcement unit is implemented as hardware circuitry that directly monitors and enforces control flow integrity, eliminating the need for complex software interpreters or virtual machines while maintaining security against ROP attacks
Solution Approach 2:
The control flow enforcement unit operates autonomously as a self-contained hardware component that independently monitors program counter values and validates control flow transitions without requiring external software intervention. The unit self-manages the validation process by comparing actual control flow against expected control flow paths defined in its internal memory
2Measurement precision
If control flow rules are evaluated during execution to detect deviations, then detection precision is improved, but processing speed decreases
Solution Approach 1:
The patent replaces software-based control flow validation with hardware-based validation that operates in parallel with normal instruction execution. The control flow enforcement unit continuously monitors program counter values and validates control flow transitions through hardware comparison logic, achieving both high detection precision and minimal impact on processing speed through concurrent operation
Solution Approach 2:
The system pre-loads expected control flow paths and validation rules into the control flow enforcement unit's internal memory during system initialization or code loading. This preliminary preparation allows the hardware unit to perform real-time validation without requiring complex runtime computation, thereby maintaining high processing speed while ensuring accurate detection of control flow deviations
Data Source
AI summary
A control flow enforcement solution for ensuring that a program or portion thereof behaves as expected during execution upon a processor. A reference control flow is pre-determined for the program using, for example, a control flow graph (CFG). The CFG is then analysed to provide a set of rules which describe how the program should behave under normal execution. As the program executes it is monitored and the rules are evaluated to enable detection of any unexpected control flow. An embodiment of this disclosure is configured to respond upon detection that a rule has been violated. The response can take the form of any appropriate intervention such as a processor interrupt, memory fault, processor reset or generation of an alert. In this way, an embodiment of this disclosure may provide a particularly effective mechanism for detecting and defending against malicious activities such as return oriented programming attacks. The invention can be utilised to effect with any program but may be particularly suited for use with programs executing upon embedded processors.