Control Flow Integrity Measurement for Fault Injection Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fault injection attacks can bypass security measures in computing devices, altering control flow and compromising system integrity, particularly targeting branch instructions in monadic error handling structures.
Innovation Solution
Implementing a fault-detection manager that maintains a measurement value for control flow, generates an expression return value, alters the measurement value based on computed results, and compares it to a predetermined value to validate the control flow, creating explicit data dependencies to detect tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security checks are performed to validate control flow, then system security is improved, but processing time increases
Solution Approach 1:
The patent embeds security metadata (control flow integrity information) directly into the executable code during compilation or linking, so that validation data is prepared in advance. This preliminary action allows runtime validation to proceed efficiently by simply checking pre-computed metadata rather than performing complex analysis during execution, thus improving security without significant time penalty
Solution Approach 2:
The patent creates compact copies of control flow information as metadata attached to the executable. Instead of storing full control flow graphs or performing exhaustive runtime analysis, the system uses condensed metadata representations that enable rapid validation checks while maintaining security integrity
2Reliability
If control flow validation is implemented, then system security is improved, but device complexity increases
Solution Approach 1:
The patent introduces metadata as an intermediary layer between the executable code and the validation mechanism. This metadata acts as a mediator that encodes control flow information in a compact, standardized format, simplifying the validation process and reducing the complexity of security checking infrastructure while maintaining robust security validation
Solution Approach 2:
The patent designs the metadata format and validation mechanism to be universally applicable across different executable formats and platforms. The same metadata structure and validation approach can be used for various types of control flow integrity checks, reducing the need for multiple specialized validation systems and thereby reducing overall system complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This document describes techniques and apparatuses directed at implementing control flow integrity measurements to validate control flow in computing systems. Within a scope, a local variable is initialized and configured to store a measurement value of a local control flow. During operations within the scope, at least one expression is computed, outputting a return value. A fingerprinting algorithm obtains the return value, combines the return value and the measurement value, and hashes the combination to produce a digest value. The local variable is then redefined as the digest value. Next, the return value is compared to the expected, distinguished success return value in a branch instruction. Before returning a final return value, the measurement value is compared against an expected value stored in a static variable. If the comparison fails, then the program can detect an attack on the control flow.