Dynamic Memory Protection via Boundary Markers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Low-end embedded devices with limited resources are vulnerable to cyber threats, particularly in critical applications where they can serve as access points to higher-level platforms and systems.
Innovation Solution
A computer-implemented method and system for generating code files that apply dynamic memory protection by analyzing code files to identify vulnerable routines, adding a memory integrity code segment to detect write operations exceeding memory block boundaries, and outputting adjusted code files that initiate predefined actions upon detection of such operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sophisticated mitigation measures are applied to counter cyber threats, then security reliability is improved, but device resource consumption increases beyond what low-end embedded devices can support
Solution Approach 1:
The patent segments the dynamic memory region into multiple blocks with boundaries, inserting markers at these boundaries. This segmentation allows the system to track and protect only the critical memory regions that are most susceptible to exploitation, rather than implementing comprehensive protection across the entire memory space, thus reducing overall resource consumption while maintaining security reliability.
Solution Approach 2:
The patent applies memory protection markers locally at specific boundaries within the dynamic memory region, particularly at the end of recently allocated blocks. This local quality approach focuses protection resources on the most vulnerable areas (recently allocated blocks that are frequently targeted in buffer overflow attacks) rather than uniformly protecting all memory regions, optimizing the balance between security and resource usage.
2Reliability
If memory protection mechanisms are implemented to detect write operations exceeding memory boundaries, then security against buffer overflow attacks is improved, but code complexity and processing overhead increase
Solution Approach 1:
The patent implements preliminary action by inserting protection markers into the dynamic memory region during the code generation phase, before the program executes. The markers are pre-placed at memory boundaries, so that during runtime, the system only needs to perform simple comparisons to detect buffer overflow attacks, rather than implementing complex runtime analysis or monitoring mechanisms.
Solution Approach 2:
The patent uses simple marker values (such as specific byte patterns like 0xAA or 0x55) as disposable protection objects. These markers are lightweight, easy to compare, and can be quickly validated without consuming significant processing resources. The simplicity of these marker objects allows for efficient runtime checking with minimal overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Presented herein are methods and systems for adjusting code files to apply memory protection for dynamic memory regions supporting run-time dynamic allocation of memory blocks. The code file(s), comprising a plurality of routines, are created for execution by one or more processors using the dynamic memory. Adjusting the code file(s) comprises analyzing the code file(s) to identify exploitation vulnerable routine(s) and adding a memory integrity code segment configured to detect, upon execution completion of each vulnerable routine, a write operation exceeding from a memory space of one or more of a subset of most recently allocated blocks allocated in the dynamic memory to a memory space of an adjacent block using marker(s) inserted in the dynamic memory in the boundary(s) of each of the subset's blocks. In runtime, in case the write operation is detected, the memory integrity code segment causes the processor(s) to initiate one or more predefined actions.