Runtime Branch Attestation for Control-Flow Hijack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems using unsafe programming languages like C and C++ are vulnerable to control-flow hijacking attacks, particularly JOP and ROP, which are difficult to detect and prevent efficiently with minimal performance overhead.
Innovation Solution
A data processing apparatus and method that includes hardware-assisted branch instructions (landmark instructions) and registers to secure branch operations, generating attestation data for integrity verification, and a verifier server to ensure secure and efficient runtime attestation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-assisted branch instructions and registers are added to detect control-flow hijacking attacks, then security and detection capability are improved, but device complexity increases
Solution Approach 1:
The patent embeds attestation logic within existing branch instruction execution flow. Hardware registers (ATTEST_REG, STATE_REG) and exception handlers are nested within the processor's existing control flow infrastructure, allowing security verification to occur within the existing device architecture rather than adding completely separate verification systems.
Solution Approach 2:
The processor automatically performs integrity verification by comparing branch target addresses against valid target sets stored in hardware registers. The exception handler automatically triggers when violations are detected, eliminating the need for external monitoring systems and reducing overall device complexity while maintaining security.
2Difficulty of detecting and measuring
If runtime integrity verification is performed during application execution, then detection capability is improved, but processing speed decreases
Solution Approach 1:
The valid branch target addresses are pre-computed and stored in hardware registers (ATTEST_REG, STATE_REG) before application execution begins. This preliminary preparation allows the runtime verification to simply compare against pre-stored values rather than performing complex analysis during execution, minimizing performance impact.
Solution Approach 2:
The patent replaces complex software-based runtime verification with simple hardware register comparisons. The processor's existing comparison and exception triggering mechanisms are used to perform integrity checks, substituting heavy computational verification with lightweight hardware operations that have minimal impact on processing speed.
3Reliability
If comprehensive attestation data is collected and reported to verifier server, then verification trustworthiness is improved, but communication overhead and processing time increase
Solution Approach 1:
The patent extracts only the essential attestation data (branch target address, state register value) needed for verification and reports it to the verifier server. By taking out only the critical information rather than reporting comprehensive execution data, the communication overhead and processing time are minimized while maintaining verification trustworthiness.
Solution Approach 2:
The attestation data format and content are optimized to include only the minimum necessary parameters for verification. The exception handler captures specific register values and branch target information in a compact format, changing the data representation to reduce communication and processing overhead while preserving verification capability.
Data Source
AI summary
A data processing apparatus includes a processing circuitry configured to execute a modified version of an application machine code defining the application. The modified version of the application machine code comprises one or more direct or indirect branch instructions and one or more machine code instructions being one or more target instructions for the one or more direct or indirect branch instructions. During the execution of the modified version of the application machine code, the processing circuitry is further configured to update a first register value in a first register and a second register value in a second register and to trigger an exception, based on the first register value and the second register value and/or when the one or more direct or indirect branch instructions target an instruction of the modified version of the application machine code.