Return Flow Guard Using Control Stack and Register
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face challenges in protecting against malicious attacks that manipulate return addresses on data stacks, leading to potential control flow hijacking and memory corruption vulnerabilities.
Innovation Solution
Implementing a return flow guard mechanism by using a control stack with a stack displacement value stored in an immutable processor register, where the return address is copied from the data stack to the control stack upon function entry and compared upon function exit, invoking a failure routine if mismatched to prevent unauthorized execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a return address is stored only on the data stack, then the device complexity is low, but the reliability is poor due to vulnerability against malicious attacks
Solution Approach 1:
The patent divides the traditional single data stack into two separate stacks: a data stack for storing return addresses and a control stack for verifying return addresses. This segmentation allows the system to maintain both simplicity and security by separating the storage function from the verification function, directly resolving the contradiction between low complexity and high reliability
Solution Approach 2:
The patent creates a copy of the return address storage mechanism by implementing a control stack that mirrors the data stack. The control stack stores copies of return addresses at the same memory locations, enabling verification without adding significant complexity to the overall system architecture
2Reliability
If the control stack base address is stored in a mutable location, then the ease of operation is high, but the reliability is poor due to potential tampering
Solution Approach 1:
The patent applies preliminary anti-action by storing the control stack base address in an immutable location (processor register or read-only memory) before any operations can occur. This prevents tampering from the outset while maintaining ease of operation, as the value is automatically available to the verification mechanism without requiring additional access controls or permissions
Solution Approach 2:
The patent introduces an intermediary layer (the immutable storage location) between the control stack base address and any potential modifying operations. This intermediary protects the integrity of the base address while allowing the verification mechanism to access it through controlled interfaces
3Reliability
If return address verification is performed, then the reliability improves, but the productivity decreases due to additional check operations
Solution Approach 1:
The patent performs preliminary action by pre-storing return addresses in the control stack before execution flow continues. This allows the verification to be a simple memory comparison operation rather than a complex validation process, minimizing the impact on execution speed while maintaining high reliability
Solution Approach 2:
The patent implements a fast verification path where, if the return address matches between data stack and control stack, execution resumes immediately without additional checks. The verification overhead is minimized to only the essential comparison operation, allowing most execution paths to proceed at full speed
Data Source
AI summary
Each program thread running on a computing device has an associated data stack and control stack. A stack displacement value is generated, which is the difference between the memory address of the base of the data stack and the memory address of the base of the control stack, and is stored in a register of a processor of the computing device that is restricted to operating system kernel use. For each thread on which return flow guard is enabled, prologue and epilogue code is added to each function of the thread (e.g., by a memory manager of the computing device). The data stack and the control stack each store a return address for the function, and when the function completes the epilogue code allows the function to return only if the return addresses on the data stack and the control stack match.