Randomized Execution Context for Code Reuse Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity defenses, such as Moving Target Defense (MTD) and Instruction Set Randomization (ISR), are vulnerable to attackers who can predict system reconfigurations or exploit code reuse attacks, leaving systems susceptible to malicious code execution.
Innovation Solution
A non-transitory computer readable medium executes instructions to determine a computing process, replace it with a code that generates a modified execution context, recompiles the binary image into an alien context, and executes it using an emulated CPU with randomized instruction sets and memory locations to thwart malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Moving Target Defense (MTD) is used to dynamically reconfigure system parameters, then system security is improved by confusing attackers, but attackers can predict system reconfigurations and circumvent the defense
Solution Approach 1:
The patent implements dynamic instruction set translation where the emulated CPU continuously changes its instruction set mapping and execution context during runtime. This dynamic reconfiguration makes it extremely difficult for attackers to predict system behavior, as the translation rules and execution environment change on-the-fly rather than following a predetermined pattern.
Solution Approach 2:
The patent introduces an emulated CPU as an intermediary layer between the attacker's malicious code and the actual system execution. This emulated CPU translates and mediates all instructions, creating an additional layer of indirection that prevents attackers from directly exploiting predictable system reconfigurations while maintaining system functionality.
2Reliability
If Instruction Set Randomization (ISR) is used to encrypt executable code, then malicious code injection is prevented, but code reuse attacks can still exploit existing code snippets
Solution Approach 1:
The patent replaces traditional encryption-based ISR with an emulated CPU system that uses dynamic instruction set translation. Instead of relying on secret keys and encryption/decryption mechanics, the system substitutes a virtualized execution environment that translates all instructions through a configurable instruction set, providing both confidentiality and preventing code reuse attacks through contextual validation.
Solution Approach 2:
The patent dynamically changes instruction set parameters and translation rules during execution. The emulated CPU modifies its instruction mapping, register allocation, and memory addressing parameters on-the-fly, ensuring that even if attackers obtain code snippets, the changing parameters render these snippets ineffective for code reuse attacks.
3Adaptability or versatility
If the system uses a fixed instruction set across threads and processes, then software compatibility is maintained, but a single vulnerability can be exploited across different hardware devices
Solution Approach 1:
The patent creates a universal emulated CPU layer that can execute any instruction set through dynamic translation. This universal interface maintains software compatibility across different instruction sets while simultaneously preventing vulnerability exploitation, as each instruction is translated and validated in the context of the emulated CPU rather than executing directly on fixed hardware instruction sets.
Data Source
AI summary
A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform cybersecurity operations. The cybersecurity operations may involve determining that an operating system has initiated a computing process, and replacing the computing process with a code configured to create a map representing a structure of an original binary image associated with the replaced computing process. A modified execution context may be generated for the computing process and the original binary image may be recompiled into an execution binary image compatible with the modified execution context. The computing process may then be executed using the execution binary image and the map.