Return Address Pointer Authentication Against ROP Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
ROP attacks compromise system security by modifying return addresses on the stack, allowing attackers to hijack control flow and execute unauthorized code.
Innovation Solution
Implement a pointer authentication feature (PAC) that signs return addresses using a secret cryptographic key based on the stack pointer and callee address, authenticating the signature before execution to prevent unauthorized control flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If return addresses are stored on the stack without authentication, then the system operates with simple control flow management, but the system becomes vulnerable to ROP attacks that compromise security
Solution Approach 1:
The patent applies preliminary action by signing the return address at the time it is pushed onto the stack, before the actual return operation occurs. This pre-authentication ensures that when the return address is later popped and executed, its integrity is already verified through the signature, preventing ROP attacks without adding complexity to the return operation itself
Solution Approach 2:
The patent introduces a cryptographic signature as an intermediary mechanism between the return address storage and execution. This signature acts as a mediator that verifies the authenticity of the return address without requiring complex authentication logic in the control flow management, thus maintaining simplicity while ensuring security
2Reliability
If cryptographic signing is applied to return addresses, then security against ROP attacks is improved, but the processing time and computational overhead increase
Solution Approach 1:
The patent applies partial action by signing only the critical return address values that are pushed onto the stack, rather than authenticating all memory operations or control flow transitions. This selective authentication of only the most vulnerable return addresses provides sufficient security against ROP attacks while minimizing the overall computational overhead and processing time
Solution Approach 2:
The patent changes the parameter of return address representation by transforming it into a signed value that includes cryptographic authentication. This parameter change allows the system to verify authenticity through the signature bitfield, enabling efficient verification that reduces the time loss compared to more extensive authentication approaches
Data Source
AI summary
In an embodiment, a processor includes hardware circuitry which may be used to detect that a return address has been modified since it was generated. In response to detecting the modification, the processor may be configured to signal an exception or otherwise initiate error handling to prevent execution at the modified return address. In an embodiment, the processor may perform a cryptographic signature operation on the return address to generate a signed return address, and the signature may be verified before the address is used as a return target.