Hardware-Assisted Indirect Branch Transfer Self-Check Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are ineffective in detecting malware at the initial trigger point due to lack of hardware assistance, allowing malicious code to bypass protection mechanisms through techniques like Return Oriented Programming and Just-in-time spraying.
Innovation Solution
The implementation of a hardware-assisted self-check mechanism using execution profiling to monitor and control indirect branch transfers, allowing for real-time policy enforcement and detection of unauthorized software without requiring signature-based detection or frequent updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-assisted execution control is implemented to detect indirect branch transfers, then malware detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an execution profiler as an intermediary component that sits between the hardware branch transfer mechanism and the software application. This profiler intercepts and monitors indirect branch transfers without requiring fundamental changes to the core processor architecture, thereby improving malware detection while limiting the increase in device complexity to a manageable monitoring layer.
Solution Approach 2:
The patent replaces traditional software-based malware detection mechanisms with a hardware-assisted execution control system. By utilizing hardware capabilities to directly profile and control branch transfers, the system achieves more reliable detection without proportionally increasing overall system complexity, as the hardware layer handles monitoring natively.
2Reliability
If execution profiling is used to monitor all indirect branch transfers, then security against control-flow attacks is improved, but processing speed decreases
Solution Approach 1:
The execution profiler monitors indirect branch transfers with selective intensity rather than uniformly blocking all such transfers. By profiling branch transfers and only intervening when suspicious patterns are detected, the system maintains high security against control-flow attacks while minimizing the impact on normal processing speed for legitimate branch operations.
Solution Approach 2:
The system implements feedback mechanisms where the execution profiler continuously monitors branch transfer patterns and adjusts its intervention level accordingly. When normal behavior is detected, monitoring proceeds with minimal overhead; when anomalous patterns suggestive of control-flow attacks emerge, the profiler increases scrutiny, thereby balancing security and performance dynamically.
Data Source
AI summary
Embodiments of the present disclosure are directed to a self-check application to determine whether an indirect branch execution is permissible for an executable application. The self-check application uses one or more parameters received from an execution profiling module to determine whether the indirect branch execution is permitted by one or more self-check policies.