Link-Time Object File Randomization for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network security methods, such as address space layout randomization and code diversification, face limitations in effectiveness and efficiency, including increased computational overhead and vulnerability to hacker exploitation, especially when not all software and operating systems support these techniques, and are hesitant to alter binary files due to potential instability and functionality loss.
Innovation Solution
A method that randomizes the order of linking object files at link time to create unique static images of a binary file, which are then distributed to trusted network devices, ensuring each execution instance has a distinct address space layout without altering the original code or adding computational overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If address space layout randomization is used to secure networks, then security is improved, but compatibility with software and operating systems deteriorates
Solution Approach 1:
The invention segments the binary file into multiple object files during the linking stage. By dividing the binary into separate compilable units, the system can randomize their linking order to create diversified binary instances, achieving security through segmentation without requiring changes to the underlying software or operating system architecture.
Solution Approach 2:
The randomization of object file linking order is performed in advance during the binary creation process, before deployment. This preliminary action creates multiple unique binary instances that are then distributed to network devices, eliminating the need for runtime randomization and ensuring compatibility with existing software and operating systems.
2Reliability
If sub-blocks of code are moved to different memory spaces for security, then security is improved, but network latency increases
Solution Approach 1:
The invention performs code diversification during the linking stage, which is a preliminary action before the binary is deployed and executed. By randomizing the linking order of object files in advance, the system creates unique binary instances without adding any runtime overhead or computational burden during network operations, thus avoiding increased network latency.
3Reliability
If binary files are altered for code diversification, then security is improved, but software stability deteriorates
Solution Approach 1:
The invention performs binary alteration in advance during the linking stage, creating diversified binary instances before deployment. This preliminary action ensures that each binary instance is pre-validated for stability and functionality, eliminating concerns about runtime instability while achieving code diversification for security.
Solution Approach 2:
The invention changes the linking order parameter of object files during binary creation, rather than altering the actual code or data content. This parameter change approach maintains software stability by preserving the integrity of the original code while achieving diversification through different linking configurations.
4Reliability
If object files are linked in randomized order, then code diversification is improved, but manufacturing complexity increases
Solution Approach 1:
The randomization of object file linking is performed as a preliminary step during the binary build process, before deployment. This approach integrates diversification into the existing compilation workflow without requiring complex runtime mechanisms or additional infrastructure, managing manufacturing complexity through advance preparation.
Data Source
AI summary
A network device is provided. The network device includes a processor and a memory with code thereupon. The code when executed by the processor causes the processor to provide object files referenced in the code, randomize an order of linking the object files in the code at a link time, and create a plurality of unique static images of a binary file based upon the randomized order.