Control Transfer Termination Instructions for ROP Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques to defend against return-oriented programming (ROP) attacks are ineffective, allowing attackers to execute unintended control transfers and chain gadgets to achieve malicious control flow changes within computer systems.
Innovation Solution
The introduction of control transfer termination (CTT) instructions, such as ENDBRANCH and ENDRET, which enforce valid control transfer points, preventing unintended control transfers and constraining the chaining of gadgets by ensuring that control transfers only occur to programmer-intended locations, thereby mitigating ROP attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current defense techniques are used, then system security is maintained, but ROP attacks can still be executed successfully
Solution Approach 1:
The patent applies preliminary anti-action by inserting control transfer termination instructions (CTT) at valid control transfer points before attackers can exploit them. These CTT instructions preemptively block gadget chaining by preventing unintended control transfers, thereby neutralizing ROP attacks before they can succeed despite existing defense techniques being in place
2Object-affected harmful factors
If control transfer termination instructions are introduced, then ROP attack resistance is improved, but instruction set complexity increases
Solution Approach 1:
The patent applies local quality by introducing control transfer termination instructions only at specific critical points (valid control transfer locations) rather than throughout the entire instruction set. This localized approach provides ROP attack resistance where needed while minimizing overall instruction set complexity and maintaining compatibility with existing instructions
3Object-affected harmful factors
If valid control transfer points are enforced, then gadget chaining is constrained, but program execution flexibility is reduced
Solution Approach 1:
The patent applies segmentation by dividing control transfer locations into distinct categories: valid control transfer points marked with CTT instructions and other locations where control transfers are blocked. This segmentation constrains gadget chaining to only authorized points while maintaining program execution flexibility through properly placed CTT instructions that preserve legitimate control flow paths
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
In one embodiment, a processor comprises: a first register to store a first bound value for a stack to be stored in a memory; a second register to store a second bound value for the stack; a checker logic to determine, prior to an exit point at a conclusion of a function to be executed on the processor, whether a value of a stack pointer is within a range between the first bound value and the second bound value; and a logic to prevent a return to a caller of the function if the stack pointer value is not within the range. Other embodiments are described and claimed.