Hardware Memory Coloring for Call Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for ensuring memory safety in computing devices, such as mobile processors, face challenges in providing comprehensive protection against attacks like return to libc and data oriented programming, while incurring significant performance overhead, and existing solutions do not guarantee memory safety beyond call flow integrity.
Innovation Solution
The implementation of a processor and memory configuration that provides branch target instruction protection and memory coloring, using distinct color values to authorize and protect memory areas, ensuring near full memory safety and call flow integrity with minimal computational or memory overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-supported shadow stacks or pointer authentication are used to enforce call-flow integrity, then memory safety protection is improved, but performance overhead increases significantly (up to 400 percent)
Solution Approach 1:
The invention segments memory into distinct colored regions (stack memory, heap memory, code memory) and applies different access rules to each segment. This segmentation allows the system to enforce memory safety without requiring complex hardware tracking of every memory access, thereby reducing performance overhead while maintaining protection.
Solution Approach 2:
The invention applies different color values to different memory regions, creating local quality variations. Each memory region has its own color that dictates access permissions, allowing fine-grained control over memory safety without uniform complexity across the entire system.
2Reliability
If CHERI fat pointers combining pointer integrity with memory segmentation are implemented, then memory safety is improved, but device complexity increases and the solution is not generally available
Solution Approach 1:
The invention changes the parameter of memory addresses by adding color values to distinguish different types of memory regions. This parameter change enables the system to enforce memory safety using existing hardware capabilities without requiring complex new architecture like CHERI fat pointers.
3Reliability
If memory coloring is applied to all memory areas including execute-only memory, then memory safety coverage is improved, but security risk increases if the coloring routine is compromised
Solution Approach 1:
The invention extracts the coloring routine from regular memory and places it in a protected system memory region that is inaccessible to user applications. This separation removes the coloring routine from the attack surface while maintaining its essential function of enforcing memory safety across all memory regions.
Data Source
AI summary
An apparatus includes a processor coupled to a memory. The processor calls a second function from a first function by coloring with an inaccessible color value a first memory area associated with the first function, branching to the second function, coloring with a second color value a second memory area associated with the second function, operating on the second memory area, and coloring with the inaccessible color value the second memory area. The processor then returns control to the first function, and colors with a first color value the first memory area. The coloring step includes branching to a coloring routine that includes a basic block beginning with a single branch target instruction, identifying and authorizing the calling routine, coloring with a hardcoded color value a memory area associated with the calling routine, and returning to the calling routine.