Return Address Verification for Buffer Overflow Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for detecting illegal access using buffer overflow, such as the return-to-libc attack, often increase CPU process load and restrict the use of other applications, degrading system usability.

Innovation Solution

An information device with a detection unit that acquires return addresses and a termination unit to identify and prevent illegal access by checking destination addresses pointed by these return addresses, without relying on CPU functions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If existing methods for detecting illegal access using buffer overflow are employed, then detection capability is improved, but CPU process load increases and system usability deteriorates

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem usability

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent extracts the detection function from CPU execution flow by implementing a separate return address verification mechanism that operates independently of the main processing loop. The return address acquisition unit and termination unit are implemented as distinct functional blocks that intercept and verify return addresses without requiring continuous CPU intervention, thereby reducing the burden on the main processing system while maintaining detection capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent implements preliminary verification of return addresses by checking whether the destination address pointed by a return address is a valid function starting address before executing the return instruction. This preliminary check prevents illegal access attempts from succeeding and avoids the need for continuous monitoring during execution, thereby reducing CPU load while maintaining security.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If CPU functions are used for detecting illegal access, then detection reliability is improved, but device complexity increases

Engineering Contradiction:

Improvedetection reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary verification mechanism that acts as a mediator between the return address stack and the function execution unit. The return address acquisition unit intercepts return addresses, and the termination unit verifies them against a database of valid function starting addresses before allowing execution to resume. This intermediary layer provides reliable detection without requiring direct CPU involvement in the verification process, thereby reducing system complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9177136B2Information device, program, method, and computer readable recording medium for preventing execution of malicious program code

Publication Date: 2015.11.03 FFRI SECURITY INC

AI summary

An information device performs data processing by executing program codes loaded in a memory with a central control unit. The information device includes a detection unit which detects a timing when any one of the program codes is called, a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory at the timing detected by the detection unit, and a termination unit which searches for an illegal access based on destination addresses that are respectively pointed by the return addresses sequentially acquired by the return address acquisition unit at the timing detected by the detection unit and which terminates the data processing when the illegal access is detected.