Inline Control Flow Monitoring for Low-Overhead CFI Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) validation techniques require source code modification and/or binary re-instrumentation, incur performance penalties, and provide limited accuracy, making them inefficient against code reuse attacks like ROP, JOP, and COP.
Innovation Solution
A hardware-assisted control flow directed graph (CFDG) monitoring system that leverages CPU telemetry to learn and enforce legitimate control flow paths, detecting and preventing invalid transfers in real-time across various computing environments, including bare metal, virtual machines, and containers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing CFI validation techniques are used, then control flow integrity is validated, but source code modification and binary re-instrumentation are required, increasing device complexity
Solution Approach 1:
The patent introduces a hardware intermediary component (performance monitoring unit or similar hardware module) that mediates between the CPU execution and the CFI validation logic. This hardware intermediary captures control transfer information directly from CPU registers and memory without requiring modifications to the application code or binary, thereby maintaining reliability while reducing device complexity.
Solution Approach 2:
The patent replaces the software-based CFI validation mechanism (which requires code instrumentation) with a hardware-based validation system. The hardware automatically monitors control flow transfers using CPU telemetry and validates them against the control flow graph, eliminating the need for mechanical code modification processes.
2Reliability
If existing CFI validation techniques are used, then control flow monitoring is provided, but performance penalties are incurred, reducing productivity
Solution Approach 1:
The patent performs preliminary actions by pre-computing and storing the control flow graph (CFG) in a data structure before runtime validation begins. The CFG is built during a profiling phase where the system observes actual control flow transfers and constructs the validation model in advance. This preliminary preparation enables fast O(1) validation lookups during runtime without impacting performance.
Solution Approach 2:
The patent creates a simplified copy of the control flow information in a hardware-accessible data structure (such as a hash table or lookup table) that mirrors the essential validation logic. Instead of performing complex runtime analysis, the system copies pre-validated control flow edges into this data structure for rapid comparison, significantly reducing validation overhead.
3Reliability
If existing CFI validation techniques are used, then control flow checks are inserted, but only limited history is provided, reducing measurement precision
Solution Approach 1:
The patent implements a dynamic control flow graph that adapts and updates during runtime based on observed control flow transfers. The system maintains a sliding window of recent execution history and dynamically adjusts the CFG to reflect actual runtime behavior, enabling precise measurement of control flow patterns while maintaining validation accuracy.
Solution Approach 2:
The patent incorporates feedback mechanisms where the system continuously monitors actual control flow transfers and uses this information to refine and update the control flow graph. The validation system provides feedback about detected transfers to update the CFG, improving measurement precision over time while maintaining reliable validation through iterative learning from observed behavior.
Data Source
AI summary
Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for a process executed on the computing system. A system call is identified during execution of the process as well as a predetermined number of transitions leading to the system call. A validity of the transitions leading the system call is determined based on the learned control flow directed graph and the computing system may perform an action based on the validity.