Runtime Protection Keys for Function Pointer Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Attackers exploit function pointer overwrite attacks to gain execution control in software programs protected by DEP and ASLR, necessitating additional security measures to prevent such attacks.
Innovation Solution
Implementing a runtime protection key system that allocates space for function pointers, instantiates a protection key, and compares it before execution, generating an error if the key does not match, thereby preventing unauthorized access and execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DEP and ASLR protections are implemented, then code execution security is improved, but function pointer overwrite attacks become more complex and challenging to prevent
Solution Approach 1:
The patent implements preliminary action by allocating protected storage space and instantiating runtime protection keys before function pointers are potentially overwritten. The protection key is stored in allocated space prior to the function pointer target, and validation checks are prepared in advance to detect overwrites before they can be exploited for code execution.
Solution Approach 2:
The patent introduces an intermediary mechanism - the runtime protection key - that acts as a mediator between the function pointer and its target. This protection key is stored in allocated space and must be validated before the function pointer can be executed, creating an intermediate validation layer that prevents direct exploitation even when overwrites occur.
2Reliability
If runtime protection keys are allocated and validated for function pointers, then function pointer overwrite attacks are prevented, but system complexity and overhead increase
Solution Approach 1:
The patent applies local quality by implementing protection selectively at specific function pointer targets rather than globally across all code. The allocated space and runtime protection keys are instantiated locally at or near the function pointer targets that need protection, allowing precise security enforcement without system-wide overhead.
Solution Approach 2:
The patent segments the protection mechanism into discrete components: allocated space for each protected function pointer, individual runtime protection keys, and localized validation logic. This segmentation allows the protection system to be implemented in modular units, reducing overall system complexity compared to a monolithic approach.
3Reliability
If protection keys are stored in allocated space prior to function pointer targets, then validation can occur before execution, but memory usage increases
Solution Approach 1:
The patent implements partial action by protecting only specific function pointer targets rather than all code references. The allocated space and protection keys are instantiated selectively at critical function pointers that are vulnerable to overwrite attacks, rather than universally across the entire program, thus reducing memory consumption while maintaining security where most needed.
Data Source
AI summary
Methods are disclosed for improving security of computer software and preventing potential attackers from gaining control of computer software via function pointer overwrite attacks. One or more additional layers of complexity may be imposed that would have to be circumvented in order to gain execution control over portions of software. One or more function pointers can be encoded using a value that may be generated on program initialization and decoded before any dynamic function call occurs. In the event of memory corruption that affects an encoded function pointer, the value will cause the destination of the function pointer to decode to an invalid and random address and will induce an error. An application may be prevented from calling an attacker corrupted function pointer by introducing various checks around the call point at compile time that check the validity of the destination to which the function pointer points.