Exception Return State Locking for GCS ROP Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented-programming (ROP) attacks target data processing systems by corrupting return state information, allowing attackers to control program flow, which existing technologies struggle to effectively protect.
Innovation Solution
Implement a guarded control stack (GCS) data structure to protect exception return state information, using an exception return state lock parameter to prevent tampering during vulnerable windows of time, and enforce memory access restrictions to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If exception return state information is stored in register storage for quick access, then processing speed is improved, but the information becomes vulnerable to corruption from unauthorized writes
Solution Approach 1:
The system performs preliminary actions by locking the exception return state information in the register storage before exception handling begins, and maintains this locked state throughout the exception handling process. This preliminary locking action prevents unauthorized writes from corrupting the return state information while still allowing the information to be quickly accessed and restored when needed.
2Reliability
If memory access restrictions are enforced for GCS regions, then security against ROP attacks is improved, but legitimate access operations may be blocked
Solution Approach 1:
The system applies local quality by implementing differentiated access controls for different memory regions. Specifically, GCS (Guarded Control Stack) regions are marked with special attributes that restrict write access to only authenticated operations, while other memory regions maintain normal access patterns. This localized security measure protects critical return state information without interfering with legitimate memory operations in non-protected regions.
3Reliability
If the exception return state lock parameter is always locked, then information integrity is maintained, but legitimate modification operations are prevented
Solution Approach 1:
The system implements dynamics by making the lock parameter state changeable based on the operational context. The exception return state lock parameter transitions between locked and unlocked states depending on whether the system is in normal operation or exception handling mode. This dynamic behavior ensures that the return state information is protected during exception handling while allowing necessary modifications during normal operation or authenticated exception setup.
Data Source
AI summary
An apparatus comprises exception return state register storage, and processing circuitry. In response to a guarded control stack (GCS) exception return state push instruction, the processing circuitry obtains exception return state information from the exception return state register storage and push the state information to a GCS data structure. In response to a GCS exception return state pop instruction, the processing circuitry obtains GCS-protected exception return state information from the GCS data structure. In at least one operating state, the processing circuitry detects, in response to an attempt to modify the exception return state information stored in the exception return state register storage, whether an exception return state lock parameter is in a locked state or an unlocked state, and signals a fault when it is in the locked state.