Processor Trace-Based Control Flow Integrity Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Control flow integrity (CFI) enforcement in real-time cyber defense systems faces challenges due to high computing resource overhead, which hinders its practicality in online processing environments, requiring a balance between precision, efficiency, and transparency.
Innovation Solution
A CFI enforcement mechanism that combines offline control flow graph construction with online monitoring of processor trace packets using Intel Processor Trace (IPT) to enforce CFI, reducing kernel resource usage by intercepting system calls, accessing processor trace packets, and matching them against a credit-labeled control flow graph, thereby conditionally invoking further processing based on credibility thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If CFI-based cyber defenses are implemented with fine-grained precision to eliminate attack surface, then security effectiveness is improved, but computing resource overhead increases and performance degradation occurs
Solution Approach 1:
The patent segments CFI enforcement into two distinct paths: a fast path for common, credible control flow transitions that incurs minimal overhead, and a slow path for suspicious or uncommon transitions that requires more intensive verification. This segmentation allows the system to maintain high security effectiveness by thoroughly checking suspicious flows while avoiding performance degradation on common operations.
Solution Approach 2:
The patent performs preliminary action by pre-computing and storing control flow graphs (CFGs) and their associated credibility information before runtime enforcement. During runtime, the system only needs to perform simple lookups and comparisons against pre-computed data, rather than performing complex analysis on-the-fly. This eliminates attack surfaces by having security policies ready in advance while minimizing runtime overhead.
2Measurement precision
If hardware-based processor traces (BTS) are used to capture all control transfer events, then tracing precision is improved, but processing overhead becomes very high and the system becomes inflexible
Solution Approach 1:
The patent applies partial action by selectively monitoring only those control flow transitions that are suspicious or lack credibility, rather than uniformly monitoring all control transfers. The system uses credibility thresholds to determine which transitions warrant detailed inspection, thereby achieving sufficient tracing precision for security purposes while dramatically reducing processing overhead compared to monitoring every single control transfer event.
Solution Approach 2:
The patent introduces dynamics by making the monitoring intensity adaptive based on credibility assessments. The system dynamically adjusts which control flow transitions are monitored closely versus which are allowed to pass through the fast path. This dynamic approach provides flexibility to handle different security scenarios while optimizing resource utilization, avoiding the inflexibility of static comprehensive monitoring.
3Productivity
If hardware-based processor traces (LBR) are used with event filtering to reduce overhead, then processing efficiency is improved, but tracing precision is sacrificed due to limited history
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of a control flow graph (CFG) that mediates between the limited LBR trace data and the security enforcement requirements. The CFG serves as a pre-computed reference structure that contains complete control flow information, allowing the system to achieve high tracing precision by comparing actual executions against the comprehensive CFG, rather than relying solely on the limited LBR history.
4Ease of operation
If CFI enforcement is made transparent to applications and easily deployable, then ease of operation is improved, but control over execution flow is reduced
Solution Approach 1:
The patent applies self-service by enabling the CFI enforcement mechanism to automatically obtain necessary information from standard system interfaces without requiring application-specific configuration or instrumentation. The system uses existing processor trace capabilities and system call interfaces to gather control flow information, and automatically performs credibility assessments and enforcement actions. This self-service approach maintains transparency to applications while preserving strong control enforcement capability through automated security policies.
Data Source
Figure 1~2
Figure 3A~3C
Figure 4~5
AI summary
A computer processing node is described that is configured to perform a control flow integrity (CFI) method on a protected process operating on the processing node. The CFI method includes intercepting a system call originating from execution of the protected process executing in the runtime environment. A fast path operating within a kernel of the computer system accesses, from a kernel memory, a processor trace packet corresponding to the system call. The fast path attempts to establish a match between the processor trace packet and a program control flow (edge) entry within a credit-labeled control flow graph (CFG) definition having an associated credit value. The credit value represents a degree to which the program control flow is credible. Thereafter, the method further includes conditionally invoking, after the matching, a slow path for further processing of the processor trace packet if the associated credit value does not meet a specified threshold, and otherwise provide an indication to permit execution of the system call.