Processor Control Transfer Override via Target Register
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Information processing systems are vulnerable to attacks like return-oriented programming (ROP) due to the potential misuse of control transfer instructions, compromising security and integrity.
Innovation Solution
Implementing a control transfer override mechanism within the processor, using a target override register (TOR) to redirect control transfers through a security layer for integrity checking, thereby mitigating ROP attacks and enhancing security without the need for fine-grained interpretation of instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If control transfer instructions are allowed to execute freely, then system performance and execution speed are improved, but security and control flow integrity deteriorate due to ROP attacks
Solution Approach 1:
The patent introduces a target override register (TOR) as an intermediary between the control transfer instruction and the actual target address. The TOR intercepts control flow transfers and redirects them through a security layer, allowing performance to be maintained while security checks are performed on the intended target addresses.
Solution Approach 2:
The control flow execution is segmented into two paths: a fast path that maintains normal execution speed for legitimate control transfers, and a security check path that validates control flow integrity. The TOR mechanism enables this segmentation by conditionally redirecting control transfers based on security requirements.
2Reliability
If traditional binary translation methods are used to prevent ROP attacks, then security is improved, but system performance deteriorates due to fine-grained interpretation overhead
Solution Approach 1:
Instead of performing fine-grained interpretation of all instructions as in traditional binary translation, the patent applies partial action by only intercepting and validating control transfer instructions. This selective approach provides adequate security against ROP attacks while minimizing performance overhead.
Solution Approach 2:
The patent extracts the security checking function from the main execution path and places it in a separate security layer. The TOR redirects control transfers to this external security layer for validation, allowing the main execution path to remain high-performance while security checks are performed separately.
Data Source
AI summary
Embodiments of an invention for control transfer overrides are disclosed. In one embodiment, a processor includes an instruction unit to receive a control transfer instruction. The instruction unit includes a transfer override register to provide an alternative target for the control transfer instruction.