Pointer Obfuscation for Cyber Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems are vulnerable to malicious software exploitation due to bugs and security vulnerabilities, particularly through stack and heap buffer overflows, which allow attackers to inject code and access unauthorized memory locations.
Innovation Solution
A security program module identifies and replaces critical memory pointers with alternate addresses, trapping unauthorized access attempts and invoking exception handlers to prevent exploitation, using a dynamic-link library loaded before program execution to obfuscate and protect memory addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory pointers are obfuscated by replacing them with alternate addresses, then security against exploitation is improved, but system complexity increases due to the need for security program modules and exception handlers
Solution Approach 1:
A security program module is introduced as an intermediary between the computer program and the memory system. This module intercepts pointer operations, replaces obfuscated pointers with valid addresses, and manages exception handling. The intermediary approach allows the system to maintain security without requiring fundamental changes to the underlying memory management architecture.
Solution Approach 2:
The security program module performs preliminary actions by pre-establishing exception handlers and setting up the pointer obfuscation mechanism before malicious exploitation can occur. The system proactively replaces pointers with obfuscated addresses and prepares exception handling routines in advance, so that when unauthorized access attempts occur, they are automatically detected and blocked without requiring real-time complex analysis.
2Reliability
If pointer obfuscation is implemented to prevent unauthorized access, then vulnerability to exploitation is reduced, but execution time increases due to trapping and exception handling overhead
Solution Approach 1:
The security mechanism applies different handling strategies to different types of pointer operations. Authorized access to obfuscated pointers is handled efficiently by the security program module through pre-established exception handlers, while unauthorized access triggers full exception processing. This local differentiation allows the system to minimize overhead for legitimate operations while maintaining strong security for suspicious access patterns.
3Object-affected harmful factors
If critical memory pointers are replaced with alternate addresses, then unauthorized access is blocked, but legitimate access becomes more difficult requiring exception handlers
Solution Approach 1:
The system implements self-service through automatic exception handling. When a program encounters an obfuscated pointer, the exception handler automatically detects whether the access is authorized or unauthorized and resolves the issue without human intervention. For authorized access, the handler transparently provides the correct memory address, making the process appear seamless to the legitimate program while blocking unauthorized access attempts.
Data Source
AI summary
A method for protecting a computer includes identifying a first pointer in a data structure used by a computer program indicating a first memory address to be accessed, using the pointer, in order to invoke a functionality of the computer. The identified first pointer is replaced with a second pointer indicating a second memory address, different from the first memory address. A security program module traps attempts to access the second memory address during execution of the computer program so as to foil unauthorized access to the functionality of the computer.