Shadow Stack Mechanism for Control Flow Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data stacks are vulnerable to control flow subversion attacks like return-oriented programming (ROP) and jump-oriented programming (JOP) due to the mixing of data and control information, and the ability for unprivileged operations to modify stack pointers and control flow, making them susceptible to hijacking.
Innovation Solution
The implementation of a shadow stack mechanism that stores control information separately from the regular stack, using a shadow stack pointer and configuring it to operate in unprivileged or privileged modes, to enhance security by isolating return addresses and preventing unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional data stack is used to store both data and control information, then memory usage is efficient and operations are simple, but the stack becomes vulnerable to control flow subversion attacks like ROP and JOP
Solution Approach 1:
The patent divides the stack into two separate structures: a conventional data stack for storing data and a shadow stack for storing control information (return addresses). This segmentation isolates control flow information from data, preventing attackers from mixing them to execute ROP/JOP attacks while maintaining the simplicity of each individual stack structure.
Solution Approach 2:
The shadow stack creates a copy of the control information that exists on the conventional stack. By maintaining a parallel shadow stack with the same control information, the system can verify integrity and prevent modification of return addresses without disrupting normal stack operations.
2Adaptability or versatility
If the stack pointer can be modified by unprivileged operations, then programming flexibility is improved, but control flow hijacking becomes possible
Solution Approach 1:
The shadow stack acts as an intermediary layer between the conventional stack and the control flow execution. By validating control information through the shadow stack before execution, the system allows flexible stack operations while preventing harmful control flow modifications.
Solution Approach 2:
The shadow stack performs preliminary verification of control information before it is executed. By checking return addresses and control flow information in advance, the system prevents hijacking attempts from succeeding, allowing flexible programming while blocking malicious operations.
3Quantity of substance
If data and control information are mixed on the same stack, then memory efficiency is maximized, but security against ROP and JOP attacks is compromised
Solution Approach 1:
The patent segments memory usage by separating data storage (conventional stack) from control information storage (shadow stack). While this uses more total memory, each stack can be optimized for its specific purpose, and the separation itself provides the security benefit by preventing mixing of data and control information.
Solution Approach 2:
The patent applies different qualities to different parts of the stack system: the conventional stack is optimized for data storage with standard operations, while the shadow stack is optimized for control information with enhanced security features. Each structure has the local quality needed for its specific function.
Data Source
AI summary
Techniques for supporting a far jump and IRET are described. An example far jump instruction support includes support for a single instruction to include at least one field for an opcode and one or more fields for an operand, wherein the opcode is to indicate execution circuitry is to perform a far jump and the operand is to specify an address to be jumped to, wherein an operand size attribute of the instance of the instruction is 32-bit or greater and the instruction has been enabled by a setting of a bit in a compatibility control register.