Return Address Encryption for Return-Oriented Programming Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Return-oriented programming attacks can bypass executable space protections by reusing existing program sequences, posing a significant security risk across various architectures, including CISC and RISC systems, as attackers can chain instructions to execute arbitrary code, evading traditional defenses like DEP and code signing.
Innovation Solution
Encrypting the return address of a function using an encryption cookie, which is decrypted before the function returns, incorporating reversible instructions in the function prologue and epilogue to secure the return address, providing a low-overhead defense against return-oriented programming attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If executable space protection (DEP) is implemented to prevent code execution in data memory, then security against traditional buffer overflow attacks is improved, but return-oriented programming attacks can still bypass this protection by reusing existing executable instructions
Solution Approach 1:
The patent changes the state of return addresses from plaintext to encrypted form. By encrypting return addresses before storing them on the stack and decrypting them only when needed for function return, the system prevents attackers from injecting and executing return-oriented programming gadgets while maintaining legitimate function returns.
2Reliability
If return addresses are encrypted to prevent return-oriented programming attacks, then security is improved, but additional encryption/decryption operations increase processing overhead
Solution Approach 1:
The patent performs encryption of return addresses in advance, during the function prologue execution, before the function body runs. This preliminary encryption action ensures that when return addresses are later needed for function returns, they are already in the correct encrypted form, minimizing runtime overhead.
Solution Approach 2:
The patent introduces an encryption cookie as an intermediary value that facilitates the encryption and decryption of return addresses. This cookie acts as a key or mediator that enables secure transformation of return addresses without requiring complex cryptographic infrastructure, thus balancing security with performance.
3Object-affected harmful factors
If encryption cookies are used to encrypt return addresses, then difficulty for attackers to decrypt return addresses increases, but implementation complexity of the security mechanism increases
Solution Approach 1:
The patent uses simple encryption cookies that can be generated easily and discarded after use. These cookies are typically random values stored in registers or memory, requiring minimal computational resources to generate and use. The simplicity of these disposable encryption objects increases attack difficulty while keeping implementation complexity low.
Data Source
AI summary
Systems and methods for the mitigation of return-oriented programming are disclosed. A return address for a function is encrypted to generate an encrypted return address. The encrypted return address is stored as the return address for the function. The encrypted return address can be decrypted prior to a return instruction of the function.