Machine Instruction Encoding for Control Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security methods, such as control flow integrity (CFI), face challenges in verifying the integrity of control flows due to semantic gaps between high-level verification and machine instruction execution, and are vulnerable to attacks that bypass verification or alter memory data values.
Innovation Solution
A method of encoding and decoding memory data using machine language with injected encoding and decoding functions, employing a mapping table to generate encryption keys for XOR operations, ensuring the integrity of control flows by storing and retrieving encoded data securely within a computer processor's memory area.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control flow integrity verification is performed at high-level software methods (system calls or procedure calls), then verification coverage is achieved, but there is a semantic gap between verification and actual machine instruction execution
Solution Approach 1:
The patent transitions the verification from high-level software methods to the machine instruction level by encoding control flow information directly into machine instructions. This dimensional shift eliminates the semantic gap by performing verification at the same level where execution occurs, using opcode modification to embed integrity checks within the instruction stream itself
Solution Approach 2:
The patent introduces an intermediary encoding mechanism that bridges verification and execution. By embedding control flow integrity data within the machine instruction structure (using opcode fields), the system creates a direct link between verification requirements and execution flow without requiring separate verification layers
2Productivity
If inherent ID verification is performed by grouping target addresses to avoid performance degradation, then performance is maintained, but it is difficult to verify the integrity of the control flow
Solution Approach 1:
The patent segments the control flow verification into individual instruction-level checks rather than grouping addresses. Each machine instruction is encoded with its own control flow integrity information, allowing verification to occur at the finest granularity without requiring address grouping, thus maintaining both performance and verification accuracy
Solution Approach 2:
The patent performs preliminary encoding of control flow integrity information directly into machine instructions during instruction generation or compilation. This pre-encoding ensures that verification data is already embedded and ready for immediate checking during execution, eliminating the need for runtime address grouping while maintaining performance
3Reliability
If verification steps are implemented in software, then control flow can be checked, but verification can be bypassed by another software or attacker due to weakness of memory data
Solution Approach 1:
The patent merges control flow verification with the machine instruction execution process itself. By embedding verification data within the instruction structure and performing checks as part of the normal execution flow, the system makes verification inseparable from execution, preventing attackers from bypassing verification without disrupting the fundamental execution mechanism
Solution Approach 2:
The patent implements self-verification where the machine instructions carry their own integrity information and perform self-checking during execution. Each instruction encodes its control flow validity and verifies itself as part of the execution process, eliminating reliance on external software verification that could be compromised
4Reliability
If encoding and decoding functions are injected into machine language for memory data protection, then control flow integrity is verified at machine instruction level, but additional encoding/decoding operations may increase processing overhead
Solution Approach 1:
The patent performs encoding of control flow integrity information during instruction generation or compilation, before execution. This preliminary encoding ensures that verification data is pre-prepared and embedded in the instruction structure, eliminating the need for complex runtime encoding operations and minimizing execution overhead
Solution Approach 2:
The patent uses simple, lightweight encoding mechanisms (such as opcode field modifications) that require minimal processing resources. The encoding and verification operations are designed to be computationally inexpensive, using basic bitwise operations rather than complex cryptographic functions, thus maintaining high execution speed
Data Source
AI summary
A method of encoding and decoding memory data for software security, includes: encoding the memory data using a machine language into which an encoding function is injected and storing the encoded memory data in the memory area; and decoding the encoded memory data in the memory area using a machine language into which a decoding function is injected and branching the decoded memory data to an address designated by a value of the memory data.