Executable Memory Protection via Dynamic Attribute Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory that is both executable and writeable poses a significant security threat as it can be exploited by malicious software, and existing technologies have not effectively addressed this vulnerability.
Innovation Solution
The system monitors calls to memory APIs to identify protection attributes and modifies them to ensure that memory is either executable or writeable but not both, using hooks and exception handlers to manage memory protection attributes, thereby reducing the likelihood of exploitation by malicious software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory is allocated as both executable and writeable to satisfy software instructions, then software functionality is maintained, but security vulnerability increases due to exploitation risk
Solution Approach 1:
The patent implements dynamic modification of memory protection attributes during runtime. The threat processor monitors software instructions and dynamically changes memory attributes from executable-writeable to either executable-nonwriteable or nonexecutable-writeable based on real-time analysis, allowing the system to adapt security measures without compromising software functionality
Solution Approach 2:
The system changes the protection attribute parameters of memory regions. By modifying the executable and writeable flags dynamically based on software behavior analysis, the system transforms memory from a high-risk state (both executable and writeable) to a lower-risk state while maintaining necessary software operations
2Object-affected harmful factors
If memory protection attributes are modified to reduce executable-writeable memory, then security is improved, but software execution may be impacted due to access restrictions
Solution Approach 1:
The system uses exception handlers that allow software to self-correct when protection attribute modifications cause access issues. When a software instruction attempts to access modified memory, an exception is generated and handled automatically, allowing the system to restore appropriate access without external intervention while maintaining security
Solution Approach 2:
The threat processor implements a feedback mechanism where it monitors software execution, analyzes behavior patterns, and adjusts memory protection attributes accordingly. This closed-loop approach ensures that security measures are optimized based on actual software behavior while minimizing impact on execution
3Object-affected harmful factors
If monitoring and modification of memory protection attributes is implemented, then security protection is enhanced, but system complexity increases due to additional processing
Solution Approach 1:
The patent introduces a threat processor as an intermediary component between the CPU and memory management. This dedicated module handles the complex tasks of monitoring API calls, analyzing software behavior, and modifying protection attributes, isolating the complexity from the core system while enhancing security capabilities
Data Source
AI summary
Examples of the present disclosure describe systems and methods for executable memory protection. In an example, calls to a memory API may be monitored to identify protection attributes of the associated memory. If software requests access to memory that is both executable and writeable, different protection attributes may be used to limit the availability of memory that is both executable and writeable. Subsequently, if software attempts to access the memory in a way not permitted by the different protection attributes, a resulting memory exception may be evaluated to determine whether to modify the memory protection attributes. In examples, the memory protection attributes may be updated accordingly (e.g., to be made executable but not writeable, writeable but not executable, etc.) and execution of the set of software instructions may resume. Thus, memory that is both executable and writeable may be reduced or eliminated; decreasing the likelihood of exploitation by malicious software.