Dynamic Stack Canary Update via Memory Mapping Circuit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static canary values in systems are vulnerable to exposure and cannot effectively detect buffer overflow attacks after the system boots, compromising security.
Innovation Solution
A method and system for dynamically updating the stack canary by extracting and updating values from an array using a processor, with a mapping circuit to manage memory regions, allowing for continuous security enhancements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a static canary value is set when the system boots, then the system can detect buffer overflow attacks initially, but the canary value becomes exposed to hackers over time and cannot be updated
Solution Approach 1:
The patent implements dynamic canary value updates by introducing a canary update module that periodically changes canary values during system operation. The canary value is no longer static but dynamically updated through a structured process involving array extraction, validation, and replacement, allowing the system to maintain security adaptability throughout its operational lifecycle.
Solution Approach 2:
The patent changes the parameter of canary values from fixed to variable by implementing an update mechanism. The canary value parameter is modified through extraction from an array, validation against expected patterns, and replacement with new values, transforming the security parameter from static to dynamically adjustable.
2Reliability
If the canary value is updated dynamically, then security is enhanced and exposure to hackers is reduced, but the system complexity increases
Solution Approach 1:
The patent segments the canary update mechanism into distinct functional modules: an array management module for storing candidate canary values, a canary update module for executing the update process, and a validation module for verifying canary integrity. This segmentation organizes the complexity into manageable, independent components with clear responsibilities.
Solution Approach 2:
The patent introduces an intermediary validation mechanism that checks whether extracted canary values meet expected patterns before applying updates. This intermediary layer ensures security and correctness without requiring complete redesign of the update mechanism, managing complexity through controlled verification.
3Reliability
If multiple canary values are stored in an array, then continuous security enhancement is enabled, but the memory usage increases
Solution Approach 1:
The patent stores multiple canary values in an array (excessive action) but only extracts and uses one value at a time (partial action). This approach enables continuous security enhancement through periodic updates while managing memory usage by maintaining a limited pool of candidate values rather than storing extensive historical data or large numbers of simultaneous canary values.
Data Source
AI summary
A canary update method according to some embodiments is disclosed. The canary update method includes executing, by a processor configured to process tasks including the canary, computer program instructions to perform operations including extracting, by a processor, a first value from an array including N values, setting the canary to the first value, determining that the canary is updated based on a canary flag value of a first task, extracting, when determined that the canary is updated, a second value from the array, and updating the canary of the first task to the second value. The processor is configured to access a memory through a mapping circuit, and the mapping circuit includes mapping information between a physical memory region in the memory corresponding to the first task and a virtual memory region associated with the mapping circuit.