Register-Based Return Address Checking Against ROP Stack Overflow
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for protecting against Return-Oriented Programming (ROP) attacks, such as duplicating the call stack in RAM, are resource-intensive and vulnerable to modification, posing challenges for embedded systems like microcontrollers.
Innovation Solution
Storing a return address and stack pointer in dedicated registers within the computer system's memory circuit, and comparing these values with their duplicates to ensure integrity, allowing the system to detect and counteract potential ROP attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the call stack is duplicated in RAM to protect against ROP attacks, then the security against ROP attacks is improved, but the memory consumption increases and the system complexity increases
Solution Approach 1:
The patent extracts only the critical security verification function from the full stack duplication approach. Instead of duplicating the entire call stack in RAM, it uses dedicated registers to store and compare only the return address and stack pointer values, reducing complexity while maintaining security protection.
Solution Approach 2:
The patent creates a simplified copy mechanism using registers to duplicate return address and stack pointer values for comparison purposes. This register-based copying replaces the complex RAM-based stack duplication, achieving the same verification function with reduced resource consumption and lower complexity.
2Reliability
If the call stack is duplicated in RAM to protect against ROP attacks, then the security against ROP attacks is improved, but the memory consumption increases
Solution Approach 1:
The patent extracts only the essential security verification data (return address and stack pointer) from the full call stack duplication approach. By using registers to store and compare these critical values, the system achieves ROP attack protection without allocating additional RAM, thus eliminating the memory consumption penalty.
Solution Approach 2:
The patent implements a register-based copying mechanism that duplicates return address and stack pointer values for security verification. This approach replaces the RAM-based duplication, achieving the same verification capability with minimal memory footprint since registers are part of the processor architecture rather than external memory.
3Reliability
If the call stack is duplicated in RAM to protect against ROP attacks, then the security against ROP attacks is improved, but the implementation complexity increases
Solution Approach 1:
The patent extracts the core security verification function and implements it using simple register operations and comparisons. This approach eliminates the need for complex stack duplication infrastructure, making the system easier to manufacture and implement while maintaining robust ROP attack protection.
Solution Approach 2:
The patent uses simple register-based copying to duplicate critical stack values for comparison. This register-level copying is inherently simpler to implement than RAM-based duplication, as it leverages the processor's existing register file and requires no additional memory management infrastructure, thereby reducing implementation complexity.
Data Source
AI summary
A computer system is provided including a memory configured to store a computer program product, a processor configured to execute said computer program product, and a memory circuit. The computer program product includes at least one instruction to duplicate in the memory circuit a return address defined upon function call, and at least one instruction to compare a value of the return address stored in a call stack at the value of the return address duplicated in the memory circuit and to permit a function return branching only if these two values are identical.