Hardware Firewall for Stack Buffer Overflow Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile electronic devices remain vulnerable to stack buffer overflow attacks despite existing security measures, as they rely on operating system vulnerabilities and lack effective hardware-based protection for secure modes in e-commerce and m-commerce transactions.
Innovation Solution
A system with multiple security levels, including a hardware-based firewall subsystem that monitors memory access signals and restricts usage if attempting to access instruction op-codes from specific memory addresses, using a multiprocessor unit, secure state machine, and security enforcement module to prevent malicious attacks by partitioning memory into secure and non-secure domains and enforcing strict access controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-based security firewalls are added to mobile devices, then security protection is improved, but the device remains vulnerable to stack buffer overflow attacks
Solution Approach 1:
The patent divides memory into separate secure and non-secure stacks, each with distinct memory regions. The secure stack is protected from buffer overflow attacks by implementing boundary checking and preventing execution of code from stack memory. This segmentation isolates critical security functions from potential attacks on general-purpose stacks.
Solution Approach 2:
The patent introduces a firewall component as an intermediary layer between the processor and memory systems. This firewall monitors and controls access to stack memory, blocking malicious code execution attempts while allowing legitimate operations. The firewall acts as a mediator that enforces security policies without disrupting normal system functionality.
2Reliability
If multiple security levels are implemented with hardware-based monitoring, then security against malicious programs is improved, but system complexity increases
Solution Approach 1:
The patent implements multiple security levels by segmenting memory into distinct secure and non-secure regions with separate stack structures. Each security level has its own protected memory space, preventing attacks from propagating across security boundaries. This segmentation provides robust security while maintaining clear architectural organization.
Solution Approach 2:
The secure stack is designed to be self-protecting through hardware-enforced boundaries and automatic security checks. The system monitors its own security state and automatically blocks unauthorized access or code execution attempts without requiring external intervention. This self-service approach reduces the burden on external security management while maintaining high security levels.
Data Source
AI summary
A system comprising control logic adapted to activate multiple security levels for the system. The system further comprises a storage coupled to the control logic and comprising a stack, the stack associated with one, but not all, of the multiple security levels. The system also comprises security logic coupled to the control logic and adapted to restrict usage of the system if the control logic attempts to fetch an instruction op-code from the stack.