Return Address Encryption via XOR Key for Control Flow Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processor security mechanisms, such as canary protection, non-executable memory, and address space layout randomization, are vulnerable to malicious code execution through control flow attacks, particularly due to the exploitation of return addresses on the stack, which can be bypassed using techniques like return-oriented programming.
Innovation Solution
Implementing XOR encryption on return addresses using a cryptographic key, both during function calls and returns, to ensure that any modification of the return address results in an unpredictable and secure memory location, thereby preventing malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms (canary protection, non-executable memory, ASLR) are used, then basic protection is provided, but they are vulnerable to control flow attacks through return address exploitation
Solution Approach 1:
The patent applies parameter changes by transforming the return address from its original plaintext form to an encrypted form using XOR operation with a cryptographic key. This parameter transformation ensures that even if the return address is intercepted or modified by malicious code, the encrypted version remains unpredictable and useless to attackers, directly resolving the vulnerability to control flow attacks while maintaining basic security mechanisms
Solution Approach 2:
The patent introduces a cryptographic key as an intermediary element between the return address and the security mechanism. This key acts as a mediator that encrypts the return address, creating an additional layer of protection. The intermediary key ensures that the return address cannot be directly exploited by malicious code, as it must first be decrypted, which is computationally infeasible without the key
2Reliability
If return addresses are encrypted using XOR operation with cryptographic key, then security against malicious code execution is significantly enhanced, but additional processing steps are required during function calls and returns
Solution Approach 1:
The patent segments the security enhancement into discrete, manageable steps: encryption of the return address before pushing to stack, and decryption after popping from stack. This segmentation allows the complex security mechanism to be integrated into existing function call and return sequences without requiring complete system redesign, thereby reducing the perceived processing complexity while maintaining high security
Solution Approach 2:
The encryption and decryption operations are self-service in nature, automatically performed by the processor during function calls and returns without requiring external security management. The cryptographic key is applied consistently through the XOR operation, which is its own inverse, allowing the same operation to serve both encryption and decryption purposes, thereby simplifying the overall processing complexity
Data Source
AI summary
Disclosed in some examples are methods, systems, and machine readable media for encrypting return addresses with a cryptographic key. The call and return operations may be changed to incorporate an XOR operation on the return address with the cryptographic key. Upon calling a function, the return address may be XORed with the key which encrypts the return address. The encrypted return address may then be placed upon the stack. Upon returning from the function, the return address may be retrieved from the stack and XORed with the cryptographic key which then decrypts the return address. The processor may then return control to the address indicated by the unencrypted return address. This method makes modifications of the return address useless as an attack vector because the result of modifying the return address will be unpredictable to the attacker as a result of the XOR operation done on the return address.