Object Flow Integrity Proxy for Secure Module Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control flow integrity (CFI) and software fault isolation (SFI) technologies face challenges in securing software applications, particularly when objects are passed between untrusted and trusted modules, as they require full source code analysis and struggle with complex flows and immutable trusted modules, leading to vulnerabilities like CODE-COOP attacks.
Innovation Solution
The implementation of object flow integrity (OFI) processes, which redirect programmatic calls between untrusted and trusted modules using proxy objects, ensuring that trusted modules do not receive writable code pointers from untrusted callers, and employing proxy objects that mediate access to enforce control flow and data flow guards, thereby preventing attacks like CODE-COOP.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CFI/SFI technologies are applied to secure software applications, then control flow hijacking attacks are prevented, but full source code analysis is required which is difficult to apply to complex flows and immutable trusted modules
Solution Approach 1:
The patent introduces a proxy object as an intermediary between untrusted and trusted modules. This proxy object mediates all object flow operations, including construction, destruction, and method invocations. By placing this intermediary layer, the system can enforce CFI/SFI policies without requiring modification or full source code analysis of the immutable trusted modules, thus resolving the contradiction between security enforcement and system complexity.
2Reliability
If trusted modules are modified to support CFI/SFI, then security is improved, but deployment flexibility is reduced and immutable modules cannot be protected
Solution Approach 1:
The patent segments the security enforcement mechanism by separating it from the trusted modules. Instead of modifying trusted modules to include CFI/SFI logic, the security functionality is segmented into a separate proxy object that handles all security-critical operations. This segmentation allows trusted modules to remain immutable while still benefiting from security enforcement, thus resolving the contradiction between security improvement and deployment flexibility.
3Adaptability or versatility
If object flow between untrusted and trusted modules is allowed, then functionality is improved, but vulnerabilities like CODE-COOP attacks increase
Solution Approach 1:
The patent applies preliminary action by enforcing security checks before any object flow operations occur. The proxy object validates all object constructions, destructions, and method invocations before they execute, ensuring that counterfeit objects cannot be created or invoked. This preliminary validation prevents CODE-COOP attacks while maintaining legitimate object flow functionality, thus resolving the contradiction between functionality and security vulnerabilities.
Data Source
AI summary
The present disclosure is directed to a method of creating an object flow integrity (OFI) library module, capable of redirecting an object-like programmatic call, by initiating a multi-pass, recursive process to analyze a module's interfaces, function parameters, and data types. In another aspect, a method is disclosed to modify the binary code of an untrusted module to enable its usage of the OFI library module. In another aspect, during runtime operations of an untrusted module, the OFI library module can receive an object from a caller module, substitute a proxy object, stored in a secure location, and continue the programmatic call using the proxy object.