Hardware Control-Flow Integrity Enforcement in RTL Design
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current control-flow integrity mechanisms face limitations in precision and practicality due to imprecise Control-Flow Graphs (CFGs) and high overhead, making them ineffective against control-flow hijacking attacks, especially in Register-Transfer Level (RTL) design where security policies are lacking.
Innovation Solution
A method and system for enforcing control-flow integrity in RTL design using a digital circuit that monitors state transitions by encoding permissible state signatures into hardware logic, generating a status signal for valid transitions, and checking this signal before executing transitions, thereby preventing unauthorized CFG execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-assisted CFI mechanisms (binary rewriting, shadow stack) are implemented, then control-flow protection is provided, but runtime overhead becomes prohibitively high
Solution Approach 1:
The patent replaces software-based CFI mechanisms with hardware-based enforcement. The control-flow graph is encoded directly into hardware logic circuits that automatically verify control-flow transitions, eliminating the need for software runtime checking and thus removing the prohibitive runtime overhead while maintaining strong security guarantees.
Solution Approach 2:
The control-flow graph is constructed and verified during the design phase rather than at runtime. By performing the analysis and enforcement setup beforehand in hardware, the system eliminates runtime overhead for CFG construction and checking, as the hardware logic is pre-configured to enforce control-flow integrity.
2Loss of time
If hardware-assisted CFI enforcement is implemented, then runtime overhead is reduced, but device complexity increases
Solution Approach 1:
The hardware enforcement mechanism is segmented into modular components: control-flow graph encoding module, transition validation module, and alarm generation module. This segmentation allows the complex functionality to be implemented through manageable, independent hardware blocks that can be synthesized and verified separately.
Solution Approach 2:
The hardware enforcement mechanism is designed to be universally applicable to any RTL design by encoding the control-flow graph of the specific design into the hardware logic. The same hardware framework can enforce CFI for different designs by reconfiguring the CFG encoding, providing multi-functionality without increasing inherent hardware complexity.
3Device complexity
If coarse-grained CFI enforcement is used, then hardware overhead is reduced, but measurement precision of control-flow monitoring deteriorates
Solution Approach 1:
The hardware enforcement can dynamically adjust its granularity based on the specific design requirements. The control-flow graph encoding can represent transitions at different levels of detail, allowing the system to optimize between overhead and precision by selecting appropriate granularity for different portions of the control-flow graph.
Data Source
AI summary
A system and method of protecting against control-flow attacks provides two complementary, transparent, and strong security policies for the RTL design at a hardware level. The approach performs static analysis of controller, followed by lightweight instrumentation, such that CFI is enforced in-place and at runtime. The modified controller follows conservative CFG with the help of a monitor.