Randomized Stack Frame Size for Cyber Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for mitigating stack-based attacks often result in significant performance degradation or high complexity, and are not feasible when source code modifications are not possible, making them inadequate for defending against buffer overflow vulnerabilities.
Innovation Solution
Applying a randomized modification to the stack frame size of a program binary, which increases the entropy of the stack frame length, making it difficult for attackers to guess or estimate the memory location of the return address, thereby rendering stack-based attacks non-viable without requiring access to source code or operating systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional methods are used to mitigate stack-based attacks, then security reliability is improved, but system performance significantly degrades
Solution Approach 1:
The patent changes the parameter of stack frame size from a fixed value to a randomized value. By introducing randomness into the stack frame size parameter, the system prevents attackers from reliably predicting memory locations while maintaining normal system operation, thus improving security without the severe performance penalties associated with traditional mitigation methods
Solution Approach 2:
The patent makes the stack frame size dynamic rather than static. The stack frame size is determined at runtime based on randomized offsets, allowing the system to adapt its security posture dynamically without requiring complex runtime checks or performance-degrading interventions during normal execution
2Reliability
If traditional methods are used to mitigate stack-based attacks, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent simplifies the mitigation approach by changing only the stack frame size parameter to a randomized value. This single parameter change provides security without requiring complex mitigation infrastructures, multiple security layers, or complicated runtime verification mechanisms that would increase device complexity
3Reliability
If source code modifications are made to fix buffer overflow vulnerabilities, then security reliability is improved, but adaptability decreases
Solution Approach 1:
The patent introduces an intermediary mechanism that operates between the attacker and the vulnerable source code. By randomizing stack frame sizes, the system creates a protective layer that renders buffer overflow exploits ineffective without requiring modifications to the original source code, thus maintaining adaptability while improving security
Solution Approach 2:
The patent creates a transformed version of the binary that incorporates randomized stack frame sizes without modifying the original source code. This copying approach allows the security enhancement to be applied to existing software while preserving the original code's functionality and adaptability
Data Source
AI summary
Systems and methods of defending against stack-based cybersecurity attacks that exploit vulnerabilities in buffer overflows. The embodiments disclosed herein propose applying a randomized modification to the original size of the stack frames of functions of a program. By applying a randomized modification to the length of the stack frame, e.g., randomly increasing the length of the allocated stack frame memory, it becomes harder (if not impossible) for the attacker to guess or estimate the memory location where the return address of a function is stored, regardless of the attacker's knowledge of the length of the stack frame. Multiple implementations, e.g., randomizations at transform time, load time, and run time are discussed herein.