Encrypted Stack Pointer Security Context Update
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory safety issues on the stack, such as stack buffer overruns, lead to security vulnerabilities by allowing access to adjacent data and control flow parameters, compromising the execution environment.
Innovation Solution
The implementation of cryptographic computing systems that use encrypted and encoded stack pointers, updated during function calls and returns, to provide cryptographic isolation between stack frames, ensuring secure access to stack data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted stack pointers are used to prevent unauthorized access to stack data, then security is improved, but exception handling becomes more complex
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing encrypted stack pointer values in a lookup table during program compilation or initialization. When an exception occurs, the handler can directly retrieve the pre-computed encrypted pointer without performing complex decryption or reconstruction operations, thus maintaining security while simplifying exception handling complexity
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a dedicated exception handling routine that mediates between the encrypted stack pointer system and the exception processing logic. This intermediary layer manages the encryption/decryption operations and pointer updates, isolating the complexity from the main exception handling flow and preserving both security and operational simplicity
2Reliability
If cryptographic isolation between stack frames is implemented, then unauthorized access is prevented, but stack frame access time increases
Solution Approach 1:
The patent applies preliminary action by pre-computing cryptographic isolation parameters and storing them in the stack frame structure during function call setup. This allows the cryptographic checks to be performed using pre-prepared data rather than computing them in real-time during access operations, thus preventing unauthorized access while minimizing access time overhead
Solution Approach 2:
The patent implements self-service by embedding cryptographic verification data directly within the stack frame structure itself. The stack frame contains encoded information that enables self-verification of access rights without requiring external cryptographic operations during access, allowing frames to essentially verify their own security boundaries autonomously and efficiently
3Reliability
If encrypted stack pointers are updated during function calls, then security context is maintained, but overhead is introduced
Solution Approach 1:
The patent applies merging by combining the encrypted stack pointer update operation with the existing function prologue code that sets up the stack frame. Instead of treating encryption as a separate overhead operation, it is integrated into the normal function entry sequence, allowing security context establishment to occur concurrently with standard stack initialization without adding separate overhead
Solution Approach 2:
The patent implements universality by designing a unified stack pointer management mechanism that handles both normal function call security context establishment and exception handling scenarios through the same encrypted pointer structure. This multi-functional approach eliminates the need for separate handling paths, reducing overall overhead while maintaining security context across different execution flows
Data Source
AI summary
A processor is to execute a first instruction to perform a simulated return in a program from a callee function to a caller function based on a first input stack pointer encoded with a first security context of a first callee stack frame. To perform the simulated return is to include generating a first simulated stack pointer to the caller stack frame. The processor is further to, in response to identifying an exception handler in the first caller function, execute a second instruction to perform a simulated call based on a second input stack pointer encoded with a second security context of the caller stack frame. To perform the simulated call is to include generating a second simulated stack pointer to a new stack frame containing an encrypted instruction pointer associated with the exception handler. The second simulated stack pointer is to be encoded with a new security context.