Dynamic Register Virtualization for ROP Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming (ROP) attacks can bypass existing security defenses like Control Flow Integrity and code diversity, as they require significant hardware or toolchain changes, introducing overhead and being predictable for attackers.
Innovation Solution
Implementing dynamic register virtualization within a processor by detecting subroutine calls, generating and applying a randomized register mapping, and stopping it at the return, making the register mapping inaccessible to attackers, thus disrupting the predictability of ROP attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Control Flow Integrity or code diversity defenses are implemented, then security against ROP attacks is improved, but hardware complexity or toolchain changes are introduced that add overhead
Solution Approach 1:
The patent changes the parameter of register allocation by introducing dynamic randomization of register mappings at runtime. Instead of using fixed or statically determined register assignments, the system generates random mappings for each execution context, making ROP attacks infeasible without requiring complex hardware modifications or toolchain changes.
Solution Approach 2:
The patent implements dynamic register virtualization where register mappings are not fixed but change dynamically during execution. The system generates different register mappings for different subroutine calls and returns to the original mapping, creating a dynamic defense mechanism that adapts to each execution context without requiring permanent hardware changes.
2Reliability
If register virtualization is applied continuously, then security against ROP attacks is improved, but processing overhead increases
Solution Approach 1:
The patent applies register virtualization periodically rather than continuously - specifically at subroutine call boundaries. The system generates a new random register mapping at each subroutine call and restores the original mapping at each return, providing security precisely when needed (when control flow transitions occur) while minimizing overhead during steady execution.
Solution Approach 2:
The patent performs preliminary setup of register mappings before subroutine execution by generating the mapping in advance at the call site. This preliminary action ensures that when the subroutine executes, the protective mapping is already in place, and the system can quickly restore the original mapping upon return without extensive computation during the critical return path.
Data Source
AI summary
A method, apparatus, and system for utilizing a register virtualization mapping to improve defense against return-oriented programming-based attacks is disclosed. A register virtualization mapping, which is bijection between nominal registers and physical registers, is generated for a subroutine call when the subroutine call is detected. The register virtualization mapping is applied to instructions within the subroutine call. The register virtualization mapping is stopped for the subroutine call at the return of the subroutine call.