Location-Based CFI Code Injection for Precise Indirect Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional control-flow hijacking attack detection methods face issues with low accuracy and high performance overhead, particularly in hardware-based techniques, and existing solutions allow multiple functions to be indirectly called, reducing detection precision.
Innovation Solution
A hardware-based method that identifies and analyzes indirect function calls, generates location information, and injects control flow integrity security code based on specific block locations, using preset or new identifiers to ensure only one function is indirectly called, thereby improving detection accuracy and reducing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hardware-based techniques allow all functions to be indirectly called, then performance overhead is reduced, but detection accuracy decreases
Solution Approach 1:
The patent applies local quality by differentiating between different function call locations. Instead of uniformly allowing all indirect calls, the system identifies specific block locations where indirect calls should be permitted versus where they should be restricted. This location-based differentiation enables the hardware to maintain high detection accuracy at critical locations while allowing legitimate indirect calls elsewhere, thus resolving the contradiction between detection accuracy and performance overhead
Solution Approach 2:
The patent segments the program code into distinct blocks and analyzes indirect function calls at the block level. By dividing the code into manageable segments and applying security checks selectively to each block, the system achieves precise detection without imposing excessive overhead on the entire program. This segmentation approach allows the hardware to efficiently monitor only the relevant blocks rather than all function calls uniformly
2Measurement precision
If software-based techniques analyze control flow using CFG or DBI, then detection accuracy is improved, but performance overhead increases
Solution Approach 1:
The patent replaces the complex software-based control flow analysis mechanisms (CFG construction and DBI) with a hardware-based approach. The processor directly analyzes indirect function calls at the block level using hardware circuits, eliminating the need for software to build and traverse call graphs. This substitution maintains high detection accuracy while significantly reducing the performance overhead associated with software-based analysis
Solution Approach 2:
The patent performs preliminary analysis of indirect function calls by identifying and categorizing them at the block level before execution. The hardware system pre-processes the code to mark legitimate indirect call locations, enabling fast verification during runtime without requiring complex software analysis. This preliminary action reduces the computational burden during program execution
Data Source
AI summary
Disclosed herein are an apparatus and method for injecting control flow integrity security code based on a location. The apparatus identifies an indirect function call in input program code, generates indirect function call location information by analyzing the identified indirect function call, and injects control flow integrity security code into the program code using the generated indirect function call location information.