Dynamic Trampoline Code Generation with Static Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional trampolines are not compatible with new generation operating systems like iPhone OS, as they generate executable codes dynamically without verifiable signatures, posing security risks and failing to meet security requirements in secure operating environments.
Innovation Solution
A method and apparatus for dynamically generating signed codes by validating executable codes with static signatures, mapping them into memory regions with specific privileges, and associating data and code pages to enable secure execution while maintaining signature integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional trampolines generate executable codes dynamically, then flexibility and functionality are improved, but security compatibility deteriorates due to lack of verifiable signatures
Solution Approach 1:
The code generation process is segmented into two distinct parts: a privileged process that creates signed code templates with verifiable signatures, and a non-privileged process that dynamically instantiates functions by referencing these signed templates. This segmentation allows dynamic code generation to maintain security through signature verification while preserving flexibility through runtime function creation.
Solution Approach 2:
Signed code templates act as an intermediary between the privileged code signing process and the non-privileged dynamic code execution process. These templates contain verifiable signatures and serve as secure blueprints that enable flexible function generation without requiring continuous privileged access, thus resolving the contradiction between security and flexibility.
2Adaptability or versatility
If privileged code generation capability is provided for non-privileged processes, then dynamic code generation is enabled, but system security risks increase due to over exposure
Solution Approach 1:
Code signing and signature verification are performed in advance during the template creation phase by a privileged process. Once signed templates are established, non-privileged processes can safely instantiate functions without requiring further privileged operations. This preliminary action eliminates the need for continuous privileged access, enabling dynamic code generation while minimizing security risks.
Solution Approach 2:
Instead of allowing non-privileged processes to create new signed code directly (which would expose security risks), the system creates copies of previously signed code templates with modified parameters. These copies inherit the verifiable signatures from the original templates, enabling flexible code generation without compromising system security.
3Adaptability or versatility
If a privileged process injects new codes, then dynamic functionality is achieved, but code caching and reuse through trampoline is prevented
Solution Approach 1:
The system creates reusable signed code templates that can be copied and instantiated multiple times with different parameters. Instead of injecting entirely new code each time, the privileged process creates master templates that non-privileged processes can reference and copy, enabling both code injection functionality and efficient caching/reuse through the trampoline mechanism.
Solution Approach 2:
Signed code templates are designed to be universal and parameterized, capable of serving multiple functions through different instantiations. A single signed template can be copied and reused with different function parameters, combining the code injection capability with efficient caching and reuse, thus eliminating the need for repeated privileged operations.
Data Source
AI summary
A method and apparatus for performing a function based on an executable code in response to receiving a request including function parameters are described. The executable code may be validated when loaded in a memory according to a signature statically signed over the executable code. A data location in the memory for storing the function parameters may be determined according location settings included inside the executable code. A target code location for storing a copy of the executable code may be determined based on the location parameters and the determined data location. A function is performed by executing the executable code from the target code location referencing the stored function parameters.