Execute-Only Memory Pages for Code Reuse Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in defending against malicious or spurious programs that initiate execution of code segments at unintended mid-points, particularly due to increasing threats from code-reuse attacks like return-oriented programming (ROP) and jump-oriented programming (JOP), which exploit existing valid code to compromise system security.
Innovation Solution
The implementation of a computing system that uses volatile registers to securely store a keystring, requiring its presence for the proper execution of protected code, and employs entry-point instructions that load this keystring into a stack pointer or other volatile registers, ensuring that protected code can only be executed as a whole unit, thereby thwarting partial or out-of-order execution attempts by malicious programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory protection mechanisms are used, then basic security is provided, but the system remains vulnerable to code-reuse attacks like ROP and JOP
Solution Approach 1:
The patent applies preliminary action by preparing protected code in advance and storing it in a non-readable memory region with execute-only permissions. The code is prepared with specific entry points and structured to prevent partial execution, so that when execution is needed, the code is already in a secure, attack-resistant state. This prevents attackers from exploiting code-reuse vulnerabilities since the code cannot be read or partially executed.
Solution Approach 2:
The patent segments code into distinct protected regions with specific access permissions. Each protected code section is isolated in its own memory region with execute-only permissions, preventing attackers from reading or copying code segments. This segmentation approach ensures that even if one code region is compromised, other regions remain protected, thereby addressing the vulnerability to code-reuse attacks.
2Reliability
If elaborate paging structures are implemented to protect code, then security against partial execution is improved, but system overhead increases substantially
Solution Approach 1:
The patent extracts the read permission from the memory access permissions for protected code regions, creating execute-only memory regions. By removing the read permission entirely from these regions, the system eliminates the need for complex paging structures and permission checks that would otherwise be required to prevent partial execution. This simplification maintains security while reducing overhead.
Solution Approach 2:
Instead of allowing read access and then restricting it through complex paging structures, the patent inverts the approach by denying read access from the outset and allowing only execute access. This inversion simplifies the memory protection mechanism, as the hardware can directly enforce execute-only permissions without requiring elaborate paging structures, thereby reducing system overhead while maintaining protection against partial execution.
3Ease of operation
If code is made readable for debugging and analysis, then ease of operation is improved, but security against malicious execution is worsened
Solution Approach 1:
The patent applies dynamics by making memory permissions changeable based on operational context. Protected code regions can be dynamically switched between execute-only mode (for security) and readable mode (for debugging). This dynamic permission switching allows the system to maintain security during normal operation while enabling debugging and analysis when needed, thereby resolving the contradiction between ease of operation and security.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The present disclosure provides a processor comprising a plurality of registers, an execution unit to execute a call instruction of a calling process, the call instruction to initiate execution of a code sequence at a higher privilege level than the calling process, the code sequence to be stored in a protected memory page not executable at the user privilege level, and a register of the plurality of registers to store a target address accessible at the higher privilege level. The execution unit is to perform an authentication operation based, at least in part, on examination of a stack, wherein responsive to a successful authentication, the execution unit is to execute the code sequence and modify the stack at the higher privilege level, and responsive to a failed authentication, the execution unit is to prevent execution of the code sequence at the higher privilege level and trigger a fault or an interrupt or alert a supervisory program.