Processor Jump Detection via Dedicated Register Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective methods to detect jump-oriented programming (JOP) attacks, which exploit modified register contents to tamper with jump destinations, potentially leading to unauthorized code execution.
Innovation Solution
The proposed solution involves a processor and an attack detection method that execute jump-related instructions in a specific privilege level mode, record execution states in a dedicated register, and determine whether corresponding instructions are legal and parameter-conformant, triggering an alert if not.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If jump-related instructions are executed using standard register contents, then program execution is simple and fast, but the system becomes vulnerable to JOP attacks where attackers can tamper with jump destinations by modifying register contents
Solution Approach 1:
The processor divides the register file into multiple independent register groups, each dedicated to storing jump destination addresses for specific privilege levels. This segmentation isolates jump target storage from general-purpose registers, preventing attackers from tampering with jump destinations through stack overflow while maintaining simple access mechanisms for legitimate jump operations.
Solution Approach 2:
The patent introduces dedicated jump destination registers as intermediary storage between the program counter and jump instructions. These intermediary registers act as a buffer that validates and controls jump destinations, preventing direct modification of jump targets while allowing controlled jumps to legitimate destinations. The intermediary structure enables security checks without significantly complicating the overall processor architecture.
2Reliability
If the processor uses dedicated registers for recording jump states in privilege level mode, then JOP attacks can be detected, but the register complexity and initialization overhead increase
Solution Approach 1:
The dedicated jump destination registers serve multiple functions: they store jump destinations for privilege level mode, provide validation references for attack detection, and maintain compatibility with standard jump operations. By designing these registers to handle both security-critical jump validation and normal program flow, the patent reduces overall system complexity while achieving reliable attack detection.
Solution Approach 2:
The processor performs preliminary initialization of jump destination registers with valid destination addresses before executing jump instructions in privilege level mode. This preliminary action establishes a baseline of expected jump destinations, enabling the detection mechanism to identify unauthorized jumps by comparing actual jump targets against the pre-initialized valid destinations, thereby achieving attack detection without complex runtime analysis.
3Reliability
If the processor validates instruction legality and parameter conformity, then unauthorized jumps are prevented, but execution time increases due to additional validation steps
Solution Approach 1:
The processor pre-validates and stores legitimate jump destination addresses in dedicated registers during system initialization or before entering privilege level mode. By performing validation in advance rather than during each jump execution, the system establishes a cache of trusted destinations that can be quickly referenced during runtime, minimizing the impact on execution speed while maintaining high validation accuracy.
Solution Approach 2:
The validation mechanism focuses specifically on validating jump destination parameters rather than performing comprehensive instruction analysis. By applying validation only to the critical jump destination parameter and using simple comparison operations against pre-stored valid destinations, the patent achieves effective attack prevention with minimal overhead on overall execution speed, avoiding excessive validation that would significantly slow down program execution.
Data Source
AI summary
The present application discloses a processor and an attack detection method thereof. The processor includes a first register and an execution unit. The execution unit is configured to: execute a first jump-related instruction under a first privilege mode; set a first field of the first register to a first jump status parameter according to execution of the first jump-related instruction; jump to a first corresponding instruction in a specified register of the first jump-related instruction; determine whether the first corresponding instruction is a legal instruction and whether a first parameter of the first corresponding instruction is equal to the first jump status parameter to obtain a first determination; and determine whether to send an alert message according to the first determination.


