Guarded Control Stack Memory Translation Against ROP Tampering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems are vulnerable to return-oriented-programming (ROP) attacks that tamper with return state information stored in memory, compromising the integrity of function or exception returns.
Innovation Solution
Implement a guarded control stack (GCS) data structure protected by a translation hardening mechanism, restricting write access to GCS regions to specific instructions and using a translation hardening mechanism to secure stage-1 translation table entries against tampering, with anti-aliasing properties enforced by a more privileged execution state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a traditional operating system memory management approach is used, then memory allocation is simple, but memory resources are wasted due to fragmentation and inability to share between applications
Solution Approach 1:
The patent divides physical memory into fixed-size blocks and uses a hierarchical management structure with memory manager, memory controller, and memory module levels. This segmentation enables fine-grained control and sharing of memory resources between multiple applications while maintaining organized management.
Solution Approach 2:
The memory management system is designed to serve multiple applications simultaneously through a unified memory space. The memory manager handles allocation, de-allocation, and sharing operations that benefit all applications, making the system versatile rather than application-specific.
2Quantity of substance
If memory is allocated to each application individually, then application isolation is maintained, but overall memory utilization is poor due to fragmentation
Solution Approach 1:
The memory management system dynamically adjusts memory allocation based on application needs and system state. The memory manager continuously monitors memory usage and performs operations like allocation, de-allocation, and compaction to optimize utilization while maintaining stability through controlled management.
Solution Approach 2:
The system changes memory allocation parameters dynamically, including block assignments, sharing permissions, and compaction thresholds. These parameter adjustments enable the system to adapt to varying memory demands while maintaining stable operation through the memory controller's coordinated management.
3Stability of the object's composition
If memory blocks are compacted frequently, then fragmentation is reduced, but system performance degrades due to operation overhead
Solution Approach 1:
The memory compaction operation is performed periodically or based on fragmentation thresholds rather than continuously. This periodic action maintains memory continuity when needed while minimizing performance impact by avoiding unnecessary compaction operations during low-fragmentation periods.
Solution Approach 2:
The memory management system performs self-optimization through automatic compaction and allocation operations without requiring external intervention. The memory manager monitors fragmentation levels and initiates compaction only when beneficial, balancing memory continuity maintenance with system performance preservation.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A target virtual address is translated to a target physical address for a memory access request. At least for write requests, the memory access request is rejected when a target stage-1 translation table entry specifies that a target memory region corresponding to the target virtual address is a guarded control stack (GCS) region for storing a GCS data structure for protecting return state information, and the memory access request is not a GCS memory access request triggered by one of a restricted subset of GCS-accessing instruction types. When an anti-aliasing property is specified for the target memory region and the target stage-1 translation table entry or another stage-1 translation table entry used to locate the target stage-1 translation table entry is an unhardened entry unprotected by a translation hardening mechanism, the memory access request is rejected. In at least one operating state, a GCS memory access request is rejected when the anti-aliasing property is not specified for the target memory region.