Native Code Instruction Selection for Mode Switching Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Native code execution environments are vulnerable to mode switching attacks, where malicious threads can exploit processor mode switches to execute instructions intended for one execution mode in another, potentially leading to unsafe operations.
Innovation Solution
The system selects and generates alternative machine language instructions for native code modules to ensure that if executed in a different processor mode, they do not perform unauthorized or unsafe operations, by evaluating and altering initial instructions to mitigate risks associated with mode switching attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If native code modules are executed with full trust access to the operating system and resources, then execution speed and functionality are improved, but security vulnerabilities and harmful operations increase
Solution Approach 1:
The patent applies local quality by differentiating trust levels for different code regions within native code modules. Specifically, it identifies and marks certain instructions as potentially harmful based on their behavior when executed in different processor modes, then applies targeted mitigation only to those specific instructions rather than restricting all native code access. This allows most native code to execute with full performance while only restricting potentially harmful instructions.
Solution Approach 2:
The patent introduces an intermediary mechanism between the native code module and the processor execution unit. This intermediary consists of metadata markers that annotate instructions with information about their potential harmfulness in different execution modes. The processor or runtime system uses this intermediary metadata to make informed decisions about whether to allow execution, thereby mediating between the native code's performance needs and security requirements.
2Device complexity
If coarse trust is applied to all applications, then implementation simplicity is maintained, but security precision and targeted protection decrease
Solution Approach 1:
The patent applies preliminary action by pre-analyzing and marking potentially harmful instructions during the native code module compilation or loading phase. Instructions that may exhibit harmful behavior when executed in different processor modes are identified and annotated with metadata markers before execution. This preliminary identification and marking simplifies the runtime security mechanism, as the system only needs to check for these pre-marked instructions rather than performing complex analysis during execution.
3Adaptability or versatility
If mode switching is allowed during native code execution, then processor versatility and execution flexibility are improved, but vulnerability to mode switching attacks increases
Solution Approach 1:
The patent applies preliminary anti-action by proactively preventing mode switching attacks before they can occur. It does this by identifying instructions that would be harmful if executed in a different processor mode than intended, and marking them with metadata. When the processor or runtime system encounters these marked instructions during execution, it can prevent the mode switch or block execution of the harmful instruction, thereby countering the potential attack before it causes damage.
4Reliability
If instructions are selected to mitigate mode switching risks, then security against attacks is improved, but instruction selection complexity and processing overhead increase
Solution Approach 1:
The patent applies this principle by using lightweight metadata markers that are inexpensive to create and store. These markers are attached to individual instructions that may be potentially harmful, rather than requiring complex analysis or transformation of the entire instruction set. The metadata serves as a simple, disposable indicator that can be quickly checked during execution without significant overhead, enabling security verification with minimal processing cost.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for selecting native code instructions. One of the methods includes receiving an initial machine language instruction for execution by a processor in a first execution mode; determining that a portion of the initial machine language instruction, when executed by the processor in a second execution mode, satisfies one or more risk criteria; generating one or more alternative machine language instructions to replace the initial machine language instruction for execution by the processor in the first execution mode, wherein the one or more alternative machine language instructions, when executed by the processor in the second execution mode, mitigate the one or more risk criteria; and providing the one or more alternative machine language instructions.