Execute-in-Place Flash Memory Bank Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing execute-in-place systems, such as NOR-based flash memory devices, cannot randomize the location of executable code in memory, as the code is written directly to flash memory and executed from there, preventing the opportunity to randomize the location, which is crucial for security against buffer overflow attacks.
Innovation Solution
A method for dynamically rewriting flash memory to randomize the location of logical blocks of execute-in-place code upon boot, using a boot loader to swap and update the positions of firmware code blocks, ensuring failure resistance and varying degrees of address space layout randomization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If executable code is written directly to flash memory and executed from there (execute-in-place), then system efficiency is improved by eliminating the need to copy code to volatile memory, but the ability to randomize code location is lost, reducing security against buffer overflow attacks
Solution Approach 1:
The flash memory is divided into multiple bank groups, where each bank group contains multiple banks and each bank can hold a complete set of executable code. This segmentation allows the system to switch between different banks containing the same code, enabling randomization of code location while maintaining execute-in-place efficiency.
Solution Approach 2:
The system changes the parameter of code location by selecting different bank groups and banks during system initialization. The boot loader randomizes which bank group and bank are activated, thereby randomizing the physical address where code is executed from, while the code remains in flash memory for direct execution.
2Object-affected harmful factors
If code location is randomized to enhance security, then security against buffer overflow attacks is improved, but system complexity increases due to the need for dynamic rewriting and management of flash memory banks
Solution Approach 1:
Multiple banks containing complete copies of the executable code are pre-written into flash memory during manufacturing or initial programming. This preliminary action ensures that when randomization is needed, the system can immediately switch to a pre-prepared bank without needing to copy or rewrite code, thus reducing the complexity of runtime management.
Solution Approach 2:
The boot loader acts as an intermediary that manages the randomization process. It randomly selects a bank group and bank, verifies the code integrity using a signature, and configures the memory mapping accordingly. This intermediary handles the complexity of bank management, keeping the rest of the system simple while enabling security enhancements.
3Object-affected harmful factors
If dynamic rewriting of flash memory is performed to randomize code location, then address space layout randomization is achieved, but the risk of writing invalid data to flash memory increases, which could cause system failure
Solution Approach 1:
The system performs verification of the selected bank before switching to it. The boot loader checks the signature of the code in the selected bank to ensure it is valid and not corrupted. This preliminary verification prevents the system from executing or switching to invalid code, maintaining reliability while enabling randomization.
Solution Approach 2:
The system maintains multiple banks with complete copies of valid code as a buffer or cushion. If the currently active bank becomes corrupted or fails, the system can switch to another valid bank without causing system failure. This redundancy cushions against potential failures during the randomization process.
Data Source
Figure 1
Figure 2
Figure 3A~3B
AI summary
A method for dynamically (i.e., upon boot) rewriting, in a failure resistant manner, of part of, or the entirety of, the flash memory for a device allows for a changing of location for logical blocks of execute-in-place code. Conveniently, the rewriting results in a randomization, of varying degree, of the address space layout upon each boot up cycle.