Randomized Memory Layouts for ROP Attack Prevention

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The template process method for launching applications in operating systems, which shares memory layouts across applications, undermines Address Space Layout Randomization (ASLR) and makes systems vulnerable to Return Oriented Programming (ROP) attacks, as attackers can infer the address space of one process by analyzing another.

Innovation Solution

Implementing multiple template processes with randomized memory layouts, configured into classes based on application types, sources, and security requirements, and setting a threshold for template process regeneration to limit shared memory space, thereby preventing attackers from deducing memory layouts across different classes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If a single template process is used to launch applications, then memory sharing efficiency is improved, but security against ROP attacks deteriorates

Engineering Contradiction:
Improvememory sharing efficiencyVSAvoidsecurity against ROP attacks
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent segments the single template process into multiple template processes (first template process and second template process) with different memory layouts. Applications are divided into different groups, each launched by a specific template process. This segmentation prevents attackers from inferring the address space of all applications, as each template process has randomized memory layout independently, thus maintaining security while preserving memory sharing efficiency within each group.

Inventive Principle:
Principle #1Segmentation

2Reliability

If memory layouts are randomized for each application, then security against ROP attacks is improved, but memory sharing efficiency deteriorates

Engineering Contradiction:
Improvesecurity against ROP attacksVSAvoidmemory sharing efficiency
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent creates multiple template processes that serve as universal launchers for groups of applications. Each template process can launch multiple applications within its group, maintaining memory sharing efficiency. The template processes are designed with universal functionality to handle different application types while maintaining their own randomized memory layouts, thus achieving both security and efficiency.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Reliability

If multiple template processes with different memory layouts are used, then security against ROP attacks is improved, but system complexity increases

Engineering Contradiction:
Improvesecurity against ROP attacksVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by making each template process have a specific, localized memory layout characteristic different from others. The first template process has a first memory layout and the second template process has a second memory layout. This localized differentiation provides security benefits while keeping the overall system manageable, as each template process is relatively simple but collectively they provide robust security.

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3163453B1Securing an application by randomizing its memory layout at launch time
Publication Date: 2022.02.02 BLACKBERRY LTD
  • EP3163453B1 patent drawingFigure 1
  • EP3163453B1 patent drawingFigure 2~3

AI summary

Systems, methods, and software can be used to launch an application. In some aspects, a plurality of process classes is configured. Each of the plurality of process classes includes one or more applications. Each of the process classes is configured to be associated with a template process. Each template process is associated with a different randomized memory layout. A launch request for an application is received. A process class that is associated with the application is determined in response to the launching request. The application is launched using the template process associated with the determined process class.