Heap Allocator with Tunable Randomization Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure memory allocators face challenges in providing effective heap security due to low randomization entropy, unstable entropy guarantees, high performance overhead, and inflexibility in adjusting security features, making them vulnerable to heap vulnerabilities like buffer overflows, use-after-frees, and double-frees.
Innovation Solution
A novel memory allocation technique that divides memory into heaps and sub-heaps, with customizable randomization entropy and guard pages, using separate allocation and deallocation buffers to enhance security and performance, allowing users to specify their desired security level without compromising performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing secure allocators (OpenBSD, DieHarder) are used to provide security guarantees, then heap security is improved, but performance overhead increases significantly (31%-74%)
Solution Approach 1:
The patent divides the heap into multiple size classes with separate free lists for each class. This segmentation allows the allocator to service allocation requests within the same size class without acquiring global locks, thereby reducing synchronization overhead and improving performance while maintaining security guarantees through structured memory management
Solution Approach 2:
The patent introduces dynamic entropy adjustment that adapts the randomization level based on security requirements and performance constraints. The entropy can be tuned to provide strong security when needed while reducing randomization overhead when performance is prioritized, resolving the contradiction between security and performance
2Reliability
If randomization entropy is increased to defend against heap vulnerabilities, then security is improved, but memory consumption increases due to larger bag sizes or more free lists
Solution Approach 1:
The patent enables dynamic adjustment of entropy as a configurable parameter. Users can set the entropy level based on their security requirements and available memory resources, allowing the system to optimize between security strength and memory consumption rather than being fixed to high entropy requirements
Solution Approach 2:
The patent implements a unified free list structure that serves multiple purposes: it maintains security through randomized allocation, manages memory efficiently across different size classes, and allows dynamic entropy adjustment. This multi-functional design eliminates the need for separate structures for each entropy level, reducing overall memory consumption
3Reliability
If entropy is increased in existing allocators, then security is improved, but the number of free lists doubles, significantly increasing memory consumption
Solution Approach 1:
The patent implements a universal free list structure that can operate at different entropy levels without requiring separate data structures. The same free list infrastructure supports variable entropy by adjusting the randomization scope and selection probability, eliminating the exponential growth in structure complexity that occurs in traditional allocators when entropy is increased
Data Source
AI summary
Memory allocation techniques may provide improved security and performance. A method may comprise mapping a block of memory, dividing the block of memory into a plurality of heaps, dividing each heap into a plurality of sub-heaps, wherein each sub-heap is associated with one thread of software executing in the computer system, dividing each sub-heap into a plurality of bags, wherein each bag is associated with one size class of objects, creating an allocation buffer and a deallocation buffer for each bag, storing a plurality of objects in at least some of the bags, wherein each object is stored in a bag having size class corresponding to a size of the object, storing in the allocation buffer of each bag information relating to available objects stored in that bag, and storing in the deallocation buffer of each bag information relating to freed objects that were stored in that bag.