Cryptographic Control-Flow Integrity via Sub-Page Key Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control-flow integrity (CFI) techniques are inadequate in preventing fault attacks that manipulate hardware faults to alter control-flow data, as they fail to resist attacks that directly modify the instruction pointer or exploit direct jumps/calls not dependent on control-flow data, and they introduce detection latency or memory waste due to code alignment padding.
Innovation Solution
The implementation of cryptographically enforced control-flow integrity using extended page table (EPT) aliasing with sub-page granular encryption (TME-MK) and 'branch+switch key ID' instructions, which bind each code unit to a cryptographic representation of authorized control flows, ensuring correct decryption and reducing memory waste through efficient key management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI techniques are used to protect control-flow data, then some level of integrity is maintained, but they fail to resist fault attacks that directly modify the instruction pointer or exploit direct jumps
Solution Approach 1:
The patent divides code into discrete units (functions, basic blocks) and assigns unique cryptographic keys to each unit. This segmentation allows the system to verify control-flow integrity at granular boundaries, preventing fault attacks from redirecting execution to unauthorized code sections without detection.
Solution Approach 2:
The system performs preliminary cryptographic binding of code units to their authorized control-flow targets before execution. By pre-computing and storing cryptographic representations (hashes, signatures) of valid control-flow transitions, the system can immediately detect any deviation caused by fault attacks without requiring runtime analysis or detection latency.
2Reliability
If traditional CFI techniques are implemented, then control-flow monitoring is provided, but detection latency is introduced
Solution Approach 1:
The system pre-computes cryptographic verification data (hashes, signatures, key bindings) for all valid control-flow transitions during code compilation or loading phases. This preliminary preparation enables immediate verification of control-flow integrity at runtime without requiring complex analysis or comparison operations, thereby eliminating detection latency.
Solution Approach 2:
The patent replaces traditional mechanical control-flow monitoring mechanisms (stack canaries, return address validation) with cryptographic verification methods. By using cryptographic primitives (hash functions, digital signatures) to verify control-flow transitions, the system achieves constant-time verification that is independent of code structure or execution path, eliminating the detection latency inherent in conventional approaches.
3Ease of manufacture
If code alignment padding is used for encryption, then memory encryption is simplified, but memory waste occurs
Solution Approach 1:
The system applies encryption with sub-page granularity, allowing different cryptographic keys to be assigned to different code units (functions, basic blocks) within the same memory page. This local differentiation eliminates the need for uniform code alignment padding across entire pages, reducing memory waste while maintaining the simplicity of cryptographic operations through key-based segmentation.
Data Source
AI summary
Techniques for cryptographically enforcing control-flow integrity are described. In certain examples, a processor includes: a cryptographic circuit to encrypt, with a first key, a first code section to be stored in a single page of memory, and to encrypt, with a second key, a second code section to be stored in the single page of memory; decoder circuitry to decode a single instruction into a decoded single instruction, the single instruction comprising a key identifier, an identifier of the second code section, and an opcode that is to indicate execution circuitry is to, when executing the first code section, determine if the key identifier corresponds to the second key, and in response to corresponding, cause the cryptographic circuit to switch to using the second key to decrypt the second code section, and transfer execution from the first code section to the second code section; and the execution circuitry to execute the decoded instruction according to the opcode.