Inter-module Control Flow Policy for Call-Oriented Attack Mitigation

The patent segments the control-flow integrity check into two distinct phases: (1) a fast coarse-grained check that verifies the target address belongs to a valid module, and (2) a finer-grained check that validates the specific function entry point within that module. This segmentation allows the system to maintain high defense effectiveness while reducing the overhead compared to full fine-grained validation of every indirect call.

The patent performs preliminary validation by pre-computing and caching the set of valid function entry points for each module before execution. During runtime, the control-flow integrity mechanism simply checks whether the indirect call target matches one of the pre-validated entry points, rather than performing complex analysis at call time. This preliminary action enables the system to defend against advanced code-reuse attacks with minimal runtime overhead.

The patent divides the validation process into hierarchical levels: first checking if the target address falls within a valid module boundary (coarse-grained), and only if that passes, then verifying the specific function entry point (fine-grained). This segmentation allows most legitimate calls to be validated quickly at the coarse level, while only suspicious calls require the more expensive fine-grained check.

The patent applies partial validation by focusing control-flow integrity checks only on indirect calls that cross module boundaries or target unusual entry points. Legitimate intra-module calls with standard entry points are assumed safe and require minimal validation. This partial action approach maintains high detection capability for attacks while reducing overall performance overhead.

The patent introduces an intermediary control-flow validation layer that sits between the application binary and the execution engine. This intermediary component intercepts indirect calls, validates them against the pre-computed set of legitimate entry points, and either allows or blocks execution. This approach achieves precise control-flow monitoring without requiring modification of the application binary itself, as the validation occurs in the intermediary layer.

The patent replaces the mechanical approach of instrumenting and modifying application binaries with a software-based validation mechanism that operates on the control flow data itself. Instead of embedding validation code within the application binary (mechanical modification), the system uses software to dynamically check control flow targets against a database of legitimate entry points, achieving the same security goal with less complexity.