FLOWSET FLOWCHECK Opcodes Control Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current control flow integrity methods, such as those employing branch flags and shadow stacks, are insufficient in preventing unauthorized control flow redirects and misdirections, allowing attackers to exploit return-oriented programming (ROP) techniques, which can compromise system security.
Innovation Solution
The introduction of FLOWSET and FLOWCHECK opcodes and operations within the processor's instruction set architecture (ISA) to identify and enforce control flow integrity by marking entry and exit points of instruction blocks, ensuring that only intended flows are executed, with fault notifications triggered for any deviations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If branch flags and shadow stacks are used to protect control flow, then some control flow integrity is achieved, but the system remains vulnerable to ROP attacks and unauthorized control flow redirects
Solution Approach 1:
The patent segments control flow protection into multiple independent verification mechanisms: branch flags for forward edges, shadow stacks for return edges, and the new FLOWSET/FLOWCHECK instructions for explicit flow boundaries. Each mechanism operates independently to provide layered defense against control flow attacks.
Solution Approach 2:
The FLOWSET instruction performs preliminary action by establishing expected control flow destinations before indirect branches are executed. The shadow stack pre-stores return addresses and the FLOWCHECK instruction verifies actual destinations match expected ones, preventing ROP attacks by checking control flow integrity in advance.
2Reliability
If existing control flow protection methods are implemented, then some security improvements are made, but precise enforcement of intended program flows is not achieved
Solution Approach 1:
The FLOWCHECK instruction provides feedback by comparing actual control flow destinations against expected destinations stored in the shadow stack. This feedback mechanism precisely detects deviations from intended program flows and triggers fault notifications, enabling precise enforcement of control flow integrity.
Solution Approach 2:
The patent replaces traditional mechanical control flow transfer with a verified system using FLOWSET/FLOWCHECK instructions. Instead of direct indirect branches, the system uses shadow stack verification and explicit flow boundary checks, substituting unverified control transfer with verified control transfer that provides precise enforcement.
3Reliability
If more control flow verification mechanisms are added, then control flow integrity is enhanced, but device complexity increases
Solution Approach 1:
The shadow stack serves multiple functions: storing return addresses for RET instructions, storing expected destinations for FLOWCHECK verification, and providing a verification mechanism for indirect branches. This multi-functionality reduces the need for separate dedicated structures for each control flow protection mechanism.
Solution Approach 2:
The FLOWSET and FLOWCHECK instructions are self-contained and work autonomously without requiring additional external verification mechanisms. The shadow stack automatically manages its own contents and the FLOWCHECK instruction independently verifies control flow, reducing the need for complex external control logic.
Data Source
AI summary
A processor and methods are provided for detecting fault in a control flow. The processor includes an instruction set architecture defining a pair of FLOWSET and FLOWCHECK opcodes and FLOWSET and FLOWCHECK operations. This pair of opcodes and associated operation works together with a CFI shadow stack to detect faults in an intended flow of instructions. Upon detection of a fault, a fault notice is provided. The methods of detecting fault in a control flow may be implemented using hardware or software and a shadow stack.