Vehicle ECU Control Flow Integrity via Function Importance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) techniques for preventing buffer overflow attacks are time-consuming and inefficient due to domain-based checks, which can allow unintended function calls and increase overhead, and previous solutions either do not apply to conventional CFI or result in significant overhead.
Innovation Solution
A program generation method that extracts control flow relationships between functions, determines their importance, and inserts check instructions into the program code to verify legitimate call-return relationships, reducing overhead by eliminating domain-based checks and optimizing the check process based on function importance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional CFI technique performs check process for all jump/return addresses, then security against buffer overflow attacks is improved, but time-related overhead increases significantly
Solution Approach 1:
The patent segments the control flow checking into two parts: a shadow call stack that stores return addresses without checking (for speed) and a selective checking mechanism that verifies specific critical functions. This segmentation allows most returns to proceed quickly while maintaining security for important functions.
Solution Approach 2:
The patent applies different checking strategies to different functions based on their importance. Critical functions have their return addresses verified, while non-critical functions use the faster shadow call stack mechanism. This local quality approach optimizes the balance between security and performance.
2Reliability
If Shadow call stack stores all return addresses, then control flow integrity is improved, but spatial overhead and memory consumption increase drastically
Solution Approach 1:
The patent extracts only the essential return addresses that need verification into a separate checking mechanism, while the shadow call stack stores all return addresses efficiently without verification overhead. This extraction minimizes the memory footprint of the checking structure while maintaining security.
Solution Approach 2:
Instead of verifying all return addresses (excessive action), the patent verifies only the necessary critical ones (partial action). This partial verification approach reduces memory consumption for checking structures while maintaining adequate security for important functions.
3Reliability
If domain-based checks are performed for function calls, then security against unintended function calls is improved, but device complexity and check process overhead increase
Solution Approach 1:
The patent implements a dynamic checking approach where the checking behavior adapts based on the importance of the function being called. The system dynamically selects between full verification and shadow stack mechanisms, avoiding the static complexity of domain-based checks while maintaining security where needed.
Solution Approach 2:
The patent changes the checking parameter (verification depth) based on function importance. For critical functions, full verification is applied; for non-critical functions, minimal checking is used. This parameter change approach simplifies the overall system compared to rigid domain-based checks.
Data Source
AI summary
A program generation method includes extracting a control flow that represents a call/return relationship between functions as well as extracting the functions themselves from a program code, determining an importance of the extracted functions; and inserting an instruction into the program code, to properly perform the control flow based on the importance of the extracted functions. Overhead that occurs during an execution of the program execution is reducible by using control flow integrity (CFI) technique that does not depend on domains.