Control Transfer Termination Instructions for ROP Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming (ROP) techniques allow attackers to execute unintended control transfers within programs, making it difficult to prevent malware from hijacking control flow without significantly increasing binary size or execution time, which is undesirable for mobile applications.
Innovation Solution
The introduction of control transfer termination (CTT) instructions, such as ENDBRANCH and ENDRET, which specify valid control transfer points, allowing hardware to enforce programmer-intended control transfers and prevent unintended gadgets from executing, while maintaining minimal performance and energy impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control transfer termination instructions are added to prevent ROP attacks, then security against unintended control transfers is improved, but binary size and device complexity increase
Solution Approach 1:
The patent introduces CTT instructions as intermediary elements that mediate between control transfer instructions (CALL, JMP, RET) and the execution flow. These instructions act as markers that define valid control transfer termination points, allowing the hardware to enforce security constraints without requiring complete rewriting of existing code. The CTT instructions serve as a bridge that enables security enforcement while maintaining compatibility with legacy software.
2Reliability
If control transfer termination instructions are added to prevent ROP attacks, then security against unintended control transfers is improved, but execution time increases
Solution Approach 1:
The patent applies preliminary action by pre-inserting CTT instructions at predetermined locations in the binary code before execution occurs. These instructions are placed at specific points where control transfers are expected to occur, establishing security constraints in advance. This allows the hardware to enforce security rules during normal execution without requiring additional runtime analysis or verification, thereby minimizing performance impact while maintaining security.
3Reliability
If control transfer termination instructions are added to prevent ROP attacks, then security against unintended control transfers is improved, but hardware complexity increases
Solution Approach 1:
The patent replaces complex software-based security mechanisms with a simpler hardware-based approach. Instead of using sophisticated software filters, emulators, or runtime analysis systems, the invention leverages the processor's existing control transfer mechanism and adds minimal hardware logic to recognize and enforce CTT instructions. This substitution of mechanical (hardware) for software-based solutions reduces overall system complexity while providing more reliable security enforcement.
4Reliability
If control transfer termination instructions are added to prevent ROP attacks, then security against unintended control transfers is improved, but energy consumption increases
Solution Approach 1:
The patent implements self-service by designing the CTT enforcement mechanism to operate automatically during normal processor execution without requiring additional power management overhead. The hardware logic that enforces CTT instructions is integrated into the existing control transfer path, allowing security checks to occur as a natural part of the execution flow rather than as separate energy-intensive operations. This self-service approach ensures that security enforcement does not significantly increase energy consumption.
Data Source
AI summary
In an embodiment, the present invention includes a processor having a decode unit, an execution unit, and a retirement unit. The decode unit is to decode control transfer instructions and the execution unit is to execute control transfer instructions. The retirement unit is to retire a first control transfer instruction, and to raise a fault if a next instruction to be retired after the first control transfer instruction is not a second control transfer instruction and a target instruction of the first control transfer instruction is in code using the control transfer instructions.