Relaxed Shadow Stack for Inter-Module Control Flow Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software technologies are inadequate in detecting and mitigating control flow attacks, especially in complex software systems with multiple modules, due to inaccuracies in disassembly and false positives, and performance overhead in real-world applications.
Innovation Solution
A cross-module detection system that uses a relaxed shadow stack and NO-EXECUTE flag to intercept and validate inter-module control flow transfers, building models from binaries and dynamically checking branch instructions to ensure legitimate control flow, reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis techniques are used to construct control flow models from binary modules, then control flow checking can be performed, but the accuracy deteriorates due to disassembly inaccuracies and inability to handle indirect branch instructions
Solution Approach 1:
The patent introduces an intermediary mechanism (shadow stack) that mediates between the control flow transfers and the checking model. Instead of directly relying on inaccurate disassembly results, the shadow stack serves as an intermediary data structure that records actual control flow transfers at runtime, bridging the gap between static analysis limitations and dynamic accuracy requirements.
Solution Approach 2:
The patent performs preliminary actions by pre-constructing control flow models from binary modules using static analysis, and pre-configuring shadow stacks for each module. This preliminary preparation allows the runtime checking to focus only on validating transfers against the pre-built models, rather than performing full disassembly and analysis at runtime.
2Reliability
If strict shadow call stack is used to detect stack smashing, then call/return pairing can be enforced, but false positives increase due to inability to handle non-standard control transfers
Solution Approach 1:
The patent transforms the static, rigid shadow call stack into a dynamic shadow stack that can adapt to different control transfer scenarios. The shadow stack is dynamically updated at runtime to reflect actual control flow transfers, allowing it to accommodate non-standard transfers like longjmp and exception handling while maintaining detection accuracy for legitimate stack smashing attacks.
Solution Approach 2:
The patent changes the parameters and structure of the shadow stack to accommodate different control transfer types. Instead of enforcing a fixed call/return pairing structure, the shadow stack parameters are adjusted to record various forms of control transfers, including indirect jumps and exception handlers, thereby reducing false positives while maintaining security.
3Measurement precision
If binary rewriting technique is used to monitor control flows, then control transfer validation can be performed, but device complexity increases due to code disassembly and modification requirements
Solution Approach 1:
The patent extracts the control flow monitoring function from the complex binary rewriting process. Instead of modifying and rewriting the entire binary code, the solution extracts only the essential control transfer validation logic and implements it through the shadow stack mechanism, significantly reducing the complexity while maintaining validation accuracy.
Solution Approach 2:
The patent creates a copy of the control flow information in the shadow stack rather than directly modifying the original binary code. This copying approach allows validation of control transfers without the complexity of binary rewriting, as the shadow stack serves as a simplified replica that tracks control flow without requiring code disassembly or modification.
4Object-affected harmful factors
If data propagation tracking is used to detect external data execution, then code injection attacks can be prevented, but performance overhead increases due to continuous tracking requirements
Solution Approach 1:
The patent extracts the essential security checking function from the complex data propagation tracking mechanism. Instead of continuously tracking all data propagation paths, the solution extracts only the critical control transfer validation and performs it through the shadow stack, significantly reducing performance overhead while maintaining protection against code injection attacks.
Solution Approach 2:
The patent applies partial action by performing validation only at control transfer points rather than continuously tracking all data propagation. The shadow stack validates control transfers selectively at module boundaries and critical points, providing sufficient security protection without the excessive performance cost of continuous full-path tracking.
Data Source
AI summary
A cross-module detection system and method for detecting and monitoring control flow transfers between software modules in a computer system. The system and method detect and monitor control flows entering and exiting the software modules. For a particular module, a checking model is extracted from the binary file of that module. In addition, a relaxed shadow stack is generated. If the module is an original module, meaning that the control flow originated from that module, then the checking model is used to check the validity of the control flow transfer. Otherwise, the relaxed shadow stack is used. An interception module is used to intercept and terminate invalid control flow transfers. If an invalid control flow transfer is detected, then the transfer is terminated. Otherwise, the control flow transfer is allowed to continue.