Hardware-Assisted Control Flow Integrity Using CPU Telemetry
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) validation techniques require source code modification and/or binary re-instrumentation, incur performance penalties, and provide limited accuracy, making them inefficient against code reuse attacks like ROP, JOP, and COP.
Innovation Solution
A hardware-assisted control flow directed graph (CFDG) monitoring system that leverages CPU telemetry to learn and enforce legitimate control flow paths, detecting and preventing invalid transfers in real-time across bare metal, virtual machines, and containerized workloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI validation techniques are used, then control flow security is improved, but source code modification and binary re-instrumentation are required, increasing device complexity
Solution Approach 1:
The patent replaces software-based CFI validation mechanisms (which require source code modification and binary re-instrumentation) with a hardware-based monitoring system. The hardware monitor circuitry directly observes control flow transfers at the CPU level, eliminating the need for mechanical/software intervention in the form of code instrumentation while achieving the same security objective.
Solution Approach 2:
The patent introduces a hardware monitor as an intermediary component between the CPU and the control flow validation process. This monitor intercepts and validates control flow transfers independently of the application code, serving as a mediator that ensures security without requiring modifications to the original software or binary.
2Reliability
If existing CFI validation techniques are used, then control flow security is improved, but performance penalty is incurred
Solution Approach 1:
The patent replaces software-based validation that consumes CPU cycles and application time with hardware-based validation that operates in parallel at the CPU level. The hardware monitor validates control flow transfers without interfering with the main execution flow, thereby eliminating the performance penalty associated with software-based CFI techniques.
Solution Approach 2:
The patent performs control flow validation in advance through hardware monitoring of control flow transfers before they can affect system security. By proactively validating each control flow transfer at the hardware level, the system prevents invalid transfers without requiring post-validation or runtime checks that would slow down execution.
3Reliability
If existing CFI validation techniques are used, then control flow security is improved, but measurement precision is limited due to limited history
Solution Approach 1:
The patent replaces software-based control flow tracking with hardware-based monitoring that directly observes control flow transfers at the CPU level. This hardware monitor captures precise information about each control flow transfer event, including source and destination addresses, without relying on limited software history buffers, thereby significantly improving measurement precision.
Solution Approach 2:
The patent creates a hardware copy of the control flow validation function that independently monitors control flow transfers. This hardware copy maintains an accurate record of valid control flow paths and compares actual transfers against this record, achieving high measurement precision without being constrained by software history limitations.
Data Source
AI summary
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining telemetry representing execution of a process on a computing system and accessing a learned control flow diagram graph for the process. A transfer of an instruction pointer is determined based on the telemetry and a validity of the transfer is determined based on the learned control flow directed graph. If invalid, then an action to terminate the process is determined, otherwise the action may be allowed to execute when valid.