Memory Categorization for Secure Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory corruption vulnerability defenses, such as Control Flow Integrity, are either expensive or insufficient in protecting against memory corruption attacks, and current full memory safety solutions incur high overhead, while attackers can still exploit vulnerabilities like Heartbleed by reading beyond memory boundaries or using dangling pointers.
Innovation Solution
The introduction of memory categorization, known as MEMCAT, which automatically separates trusted and untrusted data types in memory using separate stacks and heaps, categorizing allocations through static and dynamic analysis, and instrumenting allocations to enforce separation, thereby limiting attackers' ability to access sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full memory safety defenses are implemented, then security against memory corruption attacks is improved, but system overhead becomes prohibitively high
Solution Approach 1:
The patent segments memory into distinct categories (trusted and untrusted data types) using separate stacks and heaps. This segmentation allows selective security measures to be applied only where needed, rather than implementing full memory safety defenses across the entire memory space, thereby reducing overall system overhead while maintaining security against memory corruption attacks.
Solution Approach 2:
The patent applies different memory safety properties to different memory regions based on their trust level. Trusted data types receive full memory safety protection, while untrusted data types receive minimal or no protection. This local quality approach enables tailored security measures that reduce overhead in untrusted regions while maintaining strong security in trusted regions.
2Reliability
If control flow integrity mitigations are applied, then protection against control flow modification is improved, but protection against data leakage remains insufficient
Solution Approach 1:
The patent segments data into trusted and untrusted categories, allowing different protection strategies for each. Trusted data is protected against both control flow modification and data leakage, while untrusted data is protected only against control flow modification. This segmentation resolves the contradiction by providing appropriate protection levels for different data types.
Solution Approach 2:
The patent introduces memory categorization as an intermediary layer between the attacker and the data. By categorizing data into trusted and untrusted types, the system can mediate access control to provide fine-grained protection that addresses both control flow integrity and data leakage concerns appropriately.
3Reliability
If memory categorization is implemented, then security against memory corruption vulnerabilities is improved, but implementation complexity increases
Solution Approach 1:
The patent segments the memory management system into separate stacks and heaps for trusted and untrusted data. This segmentation, while adding some complexity, follows established memory management patterns and can be integrated with existing compilers and runtimes, thereby limiting the increase in implementation complexity while providing meaningful security improvements.
Data Source
AI summary
Separating data of trusted and untrusted data types in a memory of a computer during execution of a software program. Assigning mutually separated memory regions in the memory, namely, for each of the data types, a memory region for storing any data of the respective data type, and an additional memory region for storing any data which cannot be uniquely assigned to one of the data types. For each allocation instruction, performing a memory allocation including linking the allocation instruction to at least one data source, generating instruction-specific context information, evaluating the data source to determine the data type, associating the data type with the context information, based on the context information, assigning the allocation instruction to the memory region assigned to the evaluated data type, and allocating memory for storing data from the data source in the assigned memory region.