Heap Allocation Address Embedding Authentication for Dynamic Memory Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing dynamic memory management technologies struggle to efficiently detect and prevent security vulnerabilities such as Use-After-Free (UAF), Double Free Bug (DFB), and Heap-based Buffer Overflow (HBoF) while minimizing performance and memory overhead.
Innovation Solution
A method for detecting security vulnerabilities in dynamic memory management involves allocating a heap area in physical memory, mapping a corresponding virtual memory area, and returning a heap allocation address that includes heap authentication information, allocation address identification information, and size information. This approach enhances security by checking access permission and verifying heap authentication information during memory access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If heap authentication information and access permission checking are implemented during memory access, then security against UAF and DFB vulnerabilities is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent embeds authentication information and access permission data directly into the heap allocation address structure before memory access occurs. This preliminary encoding allows the system to verify heap authenticity and permissions during normal memory operations without adding separate verification steps, thereby improving security while minimizing additional processing complexity
Solution Approach 2:
The heap allocation address serves multiple functions simultaneously: it identifies the heap region, encodes authentication information for security verification, and contains access permission data. This multi-functionality consolidates what would otherwise require separate data structures into a single address value, improving security without proportionally increasing device complexity
2Measurement precision
If heap authentication information is verified during memory access, then detection precision for UAF and DFB vulnerabilities is improved, but productivity and performance decrease
Solution Approach 1:
The authentication information and access permissions are self-contained within the heap allocation address itself. When memory access occurs, the system extracts and verifies this information directly from the address without requiring external authentication data or complex verification routines. This self-service approach enables precise detection of UAF and DFB vulnerabilities while minimizing performance overhead by avoiding additional data fetching and processing steps
3Reliability
If access permission information is checked for every memory access to the heap area, then security against buffer overflow is improved, but use of energy and processing time increase
Solution Approach 1:
Access permission information is pre-encoded into the heap allocation address during memory allocation. This preliminary action allows the system to verify permissions by simply checking bits within the address structure itself during memory access, rather than performing complex permission verification routines. This approach improves security against buffer overflow while minimizing energy consumption by avoiding additional processing operations
Solution Approach 2:
The permission data is self-contained within the address structure, enabling the memory access mechanism to verify permissions autonomously during normal operation. This self-service verification requires minimal additional energy compared to external permission checking mechanisms, as it leverages the existing address decoding logic already present in the memory subsystem
Data Source
AI summary
Disclosed herein is a method for detecting a security vulnerability of dynamic memory. The method includes allocating a heap area in physical memory in response to a heap allocation request from a user, allocating a heap area of virtual memory corresponding to the heap area in the physical memory, and returning a heap allocation address to the user, and the heap allocation address includes heap authentication information, heap allocation address identification information, and heap size information.