Obfuscating Address Space Layout Randomization Mappings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems remain vulnerable to return-oriented programming (ROP) attacks, where attackers manipulate existing instructions in memory to gain unauthorized control, despite secure programming practices and hardware-based security measures.
Innovation Solution
Implementing fine-grained address space layout randomization by shuffling virtual memory pages into randomized clumps, obfuscating memory mappings to prevent attackers from predicting function locations and executing arbitrary instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If address space layout randomization is implemented to mitigate ROP attacks, then system security is improved, but the complexity of memory management increases
Solution Approach 1:
The patent introduces an intermediary component (the mapping module or dynamic linker) that sits between the process and the randomized memory addresses. This intermediary maintains the address mapping information and resolves function addresses indirectly, preventing attackers from directly exploiting memory layout while preserving normal system operation. The intermediary handles the complexity of managing randomized addresses without requiring changes to the core memory management subsystem.
2Object-affected harmful factors
If fine-grained randomization of memory pages is implemented, then resistance to ROP attacks is improved, but the difficulty of detecting and measuring function addresses increases
Solution Approach 1:
The patent divides the memory address space into multiple segments or clumps of pages, each randomized independently. Instead of randomizing individual pages or the entire address space as a single unit, the segmentation approach creates intermediate-level randomization units. This provides sufficient obfuscation to prevent ROP attacks while maintaining manageable complexity in the randomization scheme.
3Reliability
If indirect calls are configured without disclosing function locations, then security against code injection is improved, but the ease of operation for legitimate function calls decreases
Solution Approach 1:
The patent performs preliminary actions by pre-establishing indirect call mechanisms (such as function pointer tables or descriptor structures) before execution. The mapping information is prepared in advance, and the indirect call infrastructure is set up beforehand, so that legitimate function calls can proceed without requiring direct address disclosure. This preliminary setup maintains security while preserving operational ease during actual function execution.
Data Source
AI summary
A data processing system can use a method of fine-grained address space layout randomization to mitigate the system's vulnerability to return oriented programming security exploits. The randomization can occur at the sub-segment level by randomizing clumps of virtual memory pages. The randomized virtual memory can be presented to processes executing on the system. The mapping between memory spaces can be obfuscated using several obfuscation techniques to prevent the reverse engineering of the shuffled virtual memory mapping.