Landing Pad Markers for Return Target Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming (ROP) attacks allow hackers to execute unauthorized code by manipulating return addresses in computing devices, evading security measures like data execution prevention and code signing.
Innovation Solution
Inserting landing pads as markers in the instruction stream to validate return targets, using a combination of hardware and software to detect suspicious returns and enforce a policy to terminate the offending process, and employing colored launch and landing pads to enhance protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If ROP techniques are used to execute code by jumping to different instructions, then code execution flexibility is improved, but system security deteriorates
Solution Approach 1:
The compiler performs preliminary action by inserting landing pad instructions at valid return target locations during the compilation phase. This pre-marking of legitimate return addresses enables the processor to later distinguish between valid and invalid return targets, preventing ROP attacks that rely on jumping to unauthorized code locations.
Solution Approach 2:
Landing pad instructions serve as intermediary markers between the compiler and processor. These special instructions act as a communication bridge, encoding return target validation information that the processor can use to verify whether a returned address is legitimate, thereby mediating between code execution flexibility and security requirements.
2Reliability
If landing pads are inserted in the instruction stream to mark valid return targets, then return target validation capability is improved, but device complexity increases
Solution Approach 1:
The landing pad instructions serve multiple functions: they act as normal executable instructions while simultaneously encoding validation information for return target verification. This multi-functionality allows the instruction stream to maintain its normal flow while embedding security validation capabilities, avoiding the need for separate validation structures that would increase complexity.
Solution Approach 2:
The compiler modifies instruction parameters by inserting landing pad instructions with specific encoding patterns at return target locations. These parameter changes encode validation information within the existing instruction format, allowing the processor to detect and validate return targets without requiring fundamental changes to the instruction set architecture or processor design.
3Object-affected harmful factors
If the processor detects suspicious returns and terminates the process, then security enforcement is improved, but system productivity decreases
Solution Approach 1:
The processor implements feedback by continuously monitoring return instructions and comparing them against the landing pad markers in the instruction stream. When a return address does not match a marked landing pad, the feedback mechanism triggers process termination. This feedback loop ensures that only validated return paths are permitted, maintaining security while minimizing false positives that would unnecessarily reduce productivity.
Data Source
AI summary
Systems, apparatuses, methods, and computer-readable mediums for preventing return oriented programming (ROP) attacks. A compiler may insert landing pads adjacent to valid return targets in an instruction sequence. When a return instruction is executed, the processor may treat the return as suspicious if the target of the return instruction does not have an adjacent landing pad. Additionally, each landing pad may be encoded with a color, and a colored launch pad may be inserted into the instruction stream next to each return instruction. When a return instruction is executed, the processor may determine if the target of the return has a landing pad with the same color as the launch pad of the return instruction. Return-target pairs with color mismatches may be treated as suspicious and the offending process may be killed.