Hardware Intrusion Detection System for Binary Exploit Interdiction

Solution Overview

Problem

Current security techniques for computer systems are inadequate in detecting and interdicting attacks, particularly those involving buffer overflow and other exploits, as they often require binary-rewriting or source code analysis, and are not effective against widespread vulnerabilities in commercial off-the-shelf software.

Innovation Solution

The development of mechanisms that scan input strings for subsequences susceptible to malicious interpretation and configure the system to generate faults or events when accessing specific memory locations, allowing for real-time detection and response without the need for code examination, using hardware features to transfer control to trusted code when suspicious actions occur.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If binary-rewriting or source code analysis is used to detect attacks, then detection capability is improved, but device complexity and ease of operation deteriorate

Engineering Contradiction:

Improvedetection capabilityVSAvoidcomplexity of security mechanism

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent replaces complex software-based binary-rewriting and source code analysis mechanisms with a hardware-based intrusion detection system. The hardware IDS intercepts data streams at the hardware level and uses cryptographic hash functions to detect attacks, eliminating the need for modifying or analyzing binary code and source code, thus reducing device complexity while maintaining detection capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a hardware-based intermediary system that sits between the data stream and the target system. This hardware IDS acts as a mediator that copies and analyzes data without interfering with the normal operation of the target system, avoiding the complexity of binary-rewriting while maintaining effective attack detection.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If binary-rewriting or source code analysis is used to detect attacks, then detection capability is improved, but ease of operation deteriorates

Engineering Contradiction:

Improvedetection capabilityVSAvoidease of deployment

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent replaces complex software-based binary-rewriting and source code analysis mechanisms with a hardware-based intrusion detection system. The hardware IDS intercepts data streams at the hardware level and uses cryptographic hash functions to detect attacks, eliminating the need for modifying or analyzing binary code and source code, thus reducing device complexity while maintaining detection capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces a hardware-based intermediary system that sits between the data stream and the target system. This hardware IDS acts as a mediator that copies and analyzes data without interfering with the normal operation of the target system, avoiding the complexity of binary-rewriting while maintaining effective attack detection.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Speed

If hardware features are used to transfer control to trusted code, then speed of response is improved, but device complexity deteriorates

Engineering Contradiction:

Improveresponse speedVSAvoidcomplexity of hardware mechanism

Core Design Contradiction:

SpeedVSDevice complexity

Solution Approach 1:

The patent implements a self-service mechanism where the hardware IDS automatically generates cryptographic hash values and compares them against known attack patterns without requiring external intervention. The system autonomously detects attacks and triggers appropriate responses, reducing the need for complex external control mechanisms while maintaining fast response speed.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent uses cryptographic hash functions to transform input data into fixed-size hash values, changing the parameter representation of data from variable-length streams to fixed-size fingerprints. This transformation enables efficient comparison and detection while maintaining fast response speed without requiring complex hardware mechanisms.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS8819822B1Security method for detecting intrusions that exploit misinterpretation of supplied data

Publication Date: 2014.08.26 VMWARE INC

AI summary

Mechanisms have been developed for securing computational systems against certain forms of attack. In particular, it has been discovered that, by scanning an input string for subsequences contained therein and configuring the computational system to generate a fault (or other triggered event) coincident with access to a memory location corresponding to one or more possible interpretations of data contained in the input string, it is possible to detect and/or interdict many forms of attack. For example, some realizations may scan for subsequences susceptible to interpretation as valid, canonical addresses, or as addresses in ranges that contain code, the stack, the heap, and/or system data structures such as the global offset table. Some realizations may scan for subsequences susceptible to interpretation as format strings or as machine code or code (source or otherwise) that could be executed in an execution environment (such as a Java™ virtual machine) or compiled for execution.