Randomized Memory Allocation with Runtime Instruction Resolution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory management systems are vulnerable to malware exploits due to predictable memory allocation, leading to performance issues and fragmentation, as malware can exploit buffer overflows by identifying and redirecting program execution.
Innovation Solution
A centralized memory management scheme that randomly allocates base addresses to executable images, resolves relative addressed instructions at runtime, and shares information in system space to prevent malware identification and improve performance by minimizing I/O operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory addresses are randomly assigned to software components, then malware authors cannot identify the memory location allocated to the software component, but memory becomes fragmented and system performance deteriorates
Solution Approach 1:
The patent segments the memory address space into a base address portion and an offset portion. The base address is randomly selected from a predefined set of base addresses, while offsets are calculated relative to the base address. This segmentation allows randomized memory allocation without requiring complete randomization of the entire address space, thereby reducing memory fragmentation while maintaining security.
Solution Approach 2:
The patent changes the parameter of memory address allocation from completely random to randomized base addresses with relative offsets. By modifying the allocation strategy to use a predefined set of base addresses and calculating offsets relative to these bases, the system achieves security through randomization while avoiding the performance degradation caused by complete randomization.
2Productivity
If data is loaded into common locations in memory, then program execution is efficient, but malware can exploit buffer overflows by identifying and redirecting program execution
Solution Approach 1:
The patent applies preliminary anti-action by pre-defining a set of valid base addresses and restricting all memory allocations to these predetermined locations. This prevents malware from exploiting buffer overflows to redirect execution to arbitrary memory locations, as the offset calculations are constrained to valid ranges from the predefined base address set.
Solution Approach 2:
The patent introduces an intermediary layer between the random base address selection and the actual memory allocation. The offset calculation mechanism acts as an intermediary that translates relative addresses into absolute addresses within the constrained base address framework, maintaining execution efficiency while preventing malware exploitation.
Data Source
AI summary
Aspects of the present invention are directed at centrally managing the allocation of memory to executable images in a way that inhibits malware from identifying the location of the executable image. Moreover, performance improvements are implemented over traditional systems that enable relative addressed instruction to be resolved at runtime. In this regard, a method is provided that identifies a randomized location to load the executable image into a memory address space. Then, data that may be used to resolve the relative addressed instruction is loaded and maintained in memory. At runtime when pages that store relative addressed instructions are accessed, an arithmetic operation is performed to resolve the relative addressed instruction. As a result, only those relative addressed instructions on pages accessed during program execution are resolved.