Program Shepherding Control Flow Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for computer systems are inadequate in preventing hijacking attacks, as they primarily focus on stopping attacks during the 'enter' or 'compromise' phases, and lack effective techniques to monitor and prevent unauthorized control transfers and memory modifications, leading to vulnerabilities in modern software monocultures.
Innovation Solution
The implementation of Program Shepherding, which monitors control flow transfers to enforce security policies through Restricted Code Origins, Restricted Control Transfers, and Un-Circumventable Sandboxing, ensuring that only authorized code execution occurs and preventing bypassing of sandboxing checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures focus on stopping attacks during enter or compromise phases, then security monitoring is simplified, but the ability to prevent unauthorized control transfers is insufficient
Solution Approach 1:
The patent applies preliminary action by monitoring control flow transfers before they can execute malicious code. The system intercepts and validates control transfers to memory locations before the compromised code can run, preventing the hijacking phase from completing. This proactive approach stops attacks before they cause damage while maintaining manageable monitoring complexity through targeted observation points.
Solution Approach 2:
The patent introduces an intermediary monitoring mechanism that sits between the program execution and memory access. This intermediary observer tracks control flow transfers without interfering with normal program operation, allowing the system to detect unauthorized transfers while maintaining program functionality. The mediator approach enables reliable security monitoring with controlled complexity.
2Reliability
If all input strings are scrutinized to identify possible attacks, then known exploits can be stopped, but previously unknown or zero day attacks cannot be prevented
Solution Approach 1:
Instead of scrutinizing input strings to detect known attack patterns (bottom-up approach), the patent inverts the approach by monitoring control flow transfers from memory locations (top-down approach). This inversion allows the system to detect unauthorized code execution and control transfers regardless of whether the attack pattern is known, effectively protecting against zero day attacks by observing the actual execution behavior rather than relying on signature matching.
Solution Approach 2:
The patent replaces the mechanical signature-based detection system with a control flow monitoring mechanism. Rather than using pattern matching and string scrutiny, the system uses control flow graph observation to detect deviations from authorized execution paths. This substitution enables detection of unknown attacks by observing structural violations in control flow rather than relying on pre-programmed attack signatures.
3Ease of manufacture
If coarse-grained policy enforcement monitors only API or system calls, then implementation is simplified, but accurate monitoring of improper control transfers cannot be achieved
Solution Approach 1:
The patent applies segmentation by dividing the monitoring function into distinct phases: tracking control flow transfers, validating destination memory locations, and detecting policy violations. This segmentation allows the system to maintain simple implementation through modular monitoring components while achieving precise detection of improper control transfers at the instruction level. Each segment handles a specific aspect of control flow validation, combining simplicity with accuracy.
Solution Approach 2:
The patent transitions from coarse-grained monitoring at the API level to fine-grained monitoring at the control flow transfer level. By adding the dimension of instruction-level observation, the system achieves precise monitoring of improper control transfers while maintaining manageable complexity through targeted observation at critical junctions in the control flow graph.
Data Source
AI summary
Hijacking of an application is prevented by monitoring control flow transfers during program execution in order to enforce a security policy. At least three basic techniques are used. The first technique, Restricted Code Origins (RCO), can restrict execution privileges on the basis of the origins of instruction executed. This distinction can ensure that malicious code masquerading as data is never executed, thwarting a large class of security attacks. The second technique, Restricted Control Transfers (RCT), can restrict control transfers based on instruction type, source, and target. The third technique, Un-Circumventable Sandboxing (UCS), guarantees that sandboxing checks around any program operation will never be bypassed.