Return Address Authentication for Secure Subroutine Epilogues
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious programmers exploit return-oriented programming (ROP) and jump-oriented programming (JOP) attacks by modifying return addresses in the stack, bypassing Data Execution Prevention (DEP) techniques, leading to unauthorized control flow manipulation and potential data breaches.
Innovation Solution
A processor system implements a decode unit that identifies indirect control transfer instructions, generates cryptographic signatures for return addresses using secure keys, and authenticates them before allowing instruction commit, ensuring secure handling of subroutine epilogues by comparing signatures from a return address stack and memory stack.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signature generation and authentication is implemented for return addresses, then security against ROP and JOP attacks is improved, but processor complexity increases
Solution Approach 1:
The system generates cryptographic signatures for return addresses in advance during subroutine call execution and stores them in a return address stack (RAS). When the subroutine returns, the pre-generated signature is quickly retrieved and verified against the actual return address, eliminating the need for time-consuming signature generation at the point of authentication and reducing critical path delay.
Solution Approach 2:
A dedicated return address stack (RAS) is introduced as an intermediary data structure to store pre-generated cryptographic signatures alongside return addresses. This separate storage mechanism allows the authentication logic to efficiently retrieve and verify signatures without complicating the main instruction execution path, isolating the security functionality from the core processor architecture.
2Reliability
If signature verification is performed before instruction commit, then security is improved, but instruction execution time increases
Solution Approach 1:
Cryptographic signatures are generated and stored in the RAS during the subroutine call execution, before the return instruction is encountered. This preliminary generation allows the return instruction to simply retrieve and verify the pre-computed signature, significantly reducing the authentication time at the critical return point.
Solution Approach 2:
The system maintains continuous instruction execution flow by allowing non-critical instructions to proceed while the cryptographic authentication occurs in parallel or is quickly resolved through the pre-generated signature verification. The in-order commit requirement is satisfied without stalling the entire pipeline because the verification uses pre-computed data.
3Reliability
If return addresses are authenticated using cryptographic signatures, then control flow integrity is improved, but processing overhead increases
Solution Approach 1:
The cryptographic signature generation is performed in advance during the subroutine call, allowing the return instruction to use a simple retrieval and verification operation. This shifts the computational burden to a non-critical time point and enables faster return instruction execution, maintaining higher processing throughput.
Solution Approach 2:
The system creates and stores a copy of the return address along with its cryptographic signature in the RAS during the subroutine call. This copying mechanism allows the original return address in memory to remain unchanged while the authenticated copy is used for verification, enabling parallel execution paths and reducing processing overhead.
4Reliability
If the processor waits for authentication completion before committing instructions, then security is improved, but pipeline efficiency decreases
Solution Approach 1:
By pre-generating and storing cryptographic signatures in the RAS before the return instruction executes, the system eliminates the need for the processor to wait for signature generation during the critical return path. The verification uses pre-computed data, allowing instructions to commit in order without stalling the pipeline for cryptographic computation.
Solution Approach 2:
The system performs signature verification to the extent necessary for security (comparing the retrieved signature with the computed verification value) without requiring complete re-verification of all subroutine calls. This partial verification approach, focused only on return addresses, provides adequate security while minimizing pipeline impact.
Data Source
AI summary
Systems, apparatuses, and methods for efficient handling of subroutine epilogues. When an indirect control transfer instruction corresponding to a procedure return for a subroutine is identified, the return address and a signature are retrieved from one or more of a return address stack and the memory stack. An authenticator generates a signature based on at least a portion of the retrieved return address. While the signature is being generated, instruction processing speculatively continues. No instructions are permitted to commit yet. The generated signature is later compared to a copy of the signature generated earlier during the corresponding procedure call. A mismatch causes an exception.