Enriched Pointer Integrity Verification for Secure Binary Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for executing binary code with microprocessors are vulnerable to a broad spectrum of attacks based on erroneous use of pointers, including stack overflow, stack underflow, and temporal safety violations, as they do not effectively detect and prevent invalid pointer usage across different memory regions.
Innovation Solution
The implementation of enriched pointers that include an address and a unique identifier, along with integrity and error correction codes, to securely manage data and function pointers, ensuring that only valid pointers are used within their designated memory contexts, and modifying compiler instructions to generate and enforce these secure pointers during binary code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional pointers are used to manage memory addresses, then the ease of operation is improved, but the reliability deteriorates due to vulnerability to pointer misuse attacks
Solution Approach 1:
The patent embeds multiple layers of security information within the pointer structure itself. Each pointer contains not only the address but also associated metadata such as permissions, memory region identifiers, and validation codes. This nested structure allows the system to verify pointer validity and enforce access controls without requiring separate validation mechanisms, thus maintaining ease of operation while significantly improving reliability against pointer misuse attacks.
Solution Approach 2:
The patent transforms the traditional pointer parameter from a simple address value into a composite structure containing multiple parameters including address, permissions, memory region tags, and integrity codes. This parameter enrichment enables the system to detect and prevent various types of pointer attacks (stack overflow, use-after-free, dangling pointers) by validating these additional parameters during pointer usage, thereby improving reliability while preserving ease of operation through automated validation.
2Reliability
If enriched pointers with additional security information are implemented, then the reliability is improved, but the device complexity increases
Solution Approach 1:
The patent implements self-service mechanisms where the enriched pointer structure automatically performs validation and security checks during normal operation. The pointer carries its own validation metadata and permissions, enabling it to self-verify its validity and enforce access controls without requiring complex external validation logic. This approach improves reliability while minimizing the increase in device complexity by shifting validation responsibilities to the pointer structure itself rather than requiring additional system-level complexity.
3Reliability
If validation mechanisms are added to detect pointer misuse, then the reliability is improved, but the productivity decreases due to additional checking overhead
Solution Approach 1:
The patent performs validation actions in advance by embedding all necessary validation metadata directly into the pointer structure during pointer creation. Memory region identifiers, permissions, and integrity codes are pre-computed and attached to pointers before they are used. This preliminary action allows the system to perform rapid validation during pointer usage by simply checking pre-computed fields rather than performing complex validation routines at runtime, thus improving reliability while minimizing productivity loss.
Solution Approach 2:
The patent extracts validation logic from complex runtime verification routines and embeds it directly into the pointer structure itself. By taking out the validation requirements and incorporating them as intrinsic parts of the pointer (metadata, permissions, region tags), the system performs validation through simple field comparisons rather than complex computational checks, thereby improving reliability while maintaining high execution speed and productivity.
Data Source
AI summary
A method for executing a binary code of a secure function includes obtaining a pointer containing: a first range of bits containing the address of a line of code, and a second, different range of bits containing an identifier of the pointer, storing the line of code, this line of code containing a first integrity tag constructed or encrypted using the identifier of the pointer, loading the line of code from the address contained in the first range of bits of the pointer, verifying the integrity of the loaded line of code by constructing a second integrity tag using the identifier of the pointer contained in the second range of bits of the pointer used to load it.