Guarded Control Stack Memory Management Against ROP Tampering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems are vulnerable to return-oriented-programming (ROP) attacks that tamper with return state information stored in memory, allowing attackers to control program flow and perform unauthorized operations.
Innovation Solution
Implement a guarded control stack (GCS) data structure protected by a translation hardening mechanism, where write access to GCS regions is restricted to specific instructions, and stage-1 translation table entries are hardened using a more privileged execution state, with anti-aliasing properties enforced to prevent tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If return state information is stored in memory for function call or exception return, then program flow control is enabled, but the system becomes vulnerable to ROP attacks that can tamper with the stored information
Solution Approach 1:
The patent applies preliminary anti-action by implementing a guarded control stack (GCS) data structure that proactively prevents ROP attacks before they can occur. The GCS is specifically designed to resist tampering with return state information through hardware-enforced protection mechanisms, including restricted access permissions and anti-aliasing properties that prevent attackers from modifying return addresses or control flow information stored in the stack.
Solution Approach 2:
The patent introduces the GCS data structure as an intermediary between the regular stack and the return state information. This intermediary layer provides additional protection by separating the vulnerable return state storage from direct memory access, requiring specific privileged instructions to modify GCS contents. The GCS acts as a buffer that mediates access to return addresses, preventing direct tampering while maintaining program flow control functionality.
2Adaptability or versatility
If translation table entries are made accessible for address mapping, then address translation functionality is provided, but the translation table entries can be tampered with to compromise security
Solution Approach 1:
The patent applies local quality by implementing translation hardening at the specific level of individual translation table entries rather than protecting the entire translation table uniformly. Each translation table entry can be independently marked as hardened, providing granular protection where only critical entries (such as those mapping to GCS regions) require enhanced security. This allows the system to maintain address translation versatility while protecting only the specific entries that are security-critical.
Solution Approach 2:
The patent implements preliminary action by pre-marking certain translation table entries as hardened before potential attacks can occur. The hardening process involves setting specific permission bits and anti-aliasing properties in advance, creating a protective barrier against future tampering attempts. This preliminary protection ensures that when address translation is performed, the integrity of critical translation entries is already secured against modification or aliasing attacks.
3Reliability
If write access to GCS regions is restricted to specific instructions, then protection against unauthorized modification is improved, but the complexity of access control increases
Solution Approach 1:
The patent applies parameter changes by modifying the permission parameters of translation table entries to enforce restricted write access to GCS regions. Specific permission bits are set in the translation table entries to allow only certain privileged instructions to write to GCS regions, while blocking all other write access. This parameter-based control mechanism provides strong protection without requiring complex access control logic, as the restrictions are enforced through the existing translation and permission checking infrastructure.
4Object-affected harmful factors
If anti-aliasing properties are enforced for GCS regions, then tampering prevention is enhanced, but the number of security checks increases
Solution Approach 1:
The patent merges the anti-aliasing property enforcement with the existing address translation and permission checking processes. Rather than implementing separate anti-aliasing checks, the patent integrates the anti-aliasing verification into the translation table lookup and permission validation that already occur during memory access. This combining of security functions reduces the number of separate security checks while maintaining comprehensive protection against aliasing-based tampering attacks.
Data Source
AI summary
A target virtual address is translated to a target physical address for a memory access request. At least for write requests, the memory access request is rejected when a target stage-1 translation table entry specifies that a target memory region corresponding to the target virtual address is a guarded control stack (GCS) region for storing a GCS data structure for protecting return state information, and the memory access request is not a GCS memory access request triggered by one of a restricted subset of GCS-accessing instruction types. When an anti-aliasing property is specified for the target memory region and the target stage-1 translation table entry or another stage-1 translation table entry used to locate the target stage-1 translation table entry is an unhardened entry unprotected by a translation hardening mechanism, the memory access request is rejected. In at least one operating state, a GCS memory access request is rejected when the anti-aliasing property is not specified for the target memory region.