Hardware Shadow Stack Pointer Switching for Control Flow Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processor technologies lack effective mechanisms to securely switch shadow stack pointers without compromising the integrity of the shadow stack, making them vulnerable to attacks like return-oriented programming (ROP), jump-oriented programming (JOP), and context-oriented programming (COP), which can lead to unauthorized control flow manipulation.
Innovation Solution
A hardware processor is designed with instructions to save and restore shadow stack pointers, ensuring secure switching by aligning the shadow stack and using tokens that include the shadow stack pointer and operating mode, with checks to prevent unauthorized modifications, allowing only valid operating system setups and user-level operations without direct user-level manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow stack pointer switching is implemented without hardware support, then software-based switching can be used, but security integrity is compromised and vulnerabilities to ROP, JOP, and COP attacks remain
Solution Approach 1:
The patent introduces hardware intermediary components including a shadow stack pointer register, token register, and validation circuitry that mediate between the shadow stack memory and the processor control flow. These hardware elements enforce security integrity by validating tokens and managing pointer switching, preventing unauthorized ROP, JOP, and COP attacks while maintaining a manageable architectural complexity through dedicated hardware modules.
2Reliability
If shadow stack pointer switching instructions are added to the processor, then secure switching capability is provided, but the instruction set architecture becomes more complex
Solution Approach 1:
The patent implements secure shadow stack pointer switching through specialized instructions that copy and validate security tokens along with pointer values. The save shadow stack pointer instruction copies the current pointer to a token register, and the restore instruction copies a validated token back to the pointer register. This copying mechanism with hardware validation provides secure control flow switching while keeping the instruction set extensions manageable through straightforward copy-then-validate operations.
3Ease of operation
If user-level operations are allowed to manipulate shadow stack pointers, then ease of operation is improved, but security against malicious attacks is compromised
Solution Approach 1:
The patent implements feedback-based security validation where hardware circuitry continuously monitors and validates shadow stack pointer operations. When a restore shadow stack pointer instruction executes, the hardware feedback mechanism checks whether the token is valid and whether the operation is authorized before allowing the pointer change. This feedback validation prevents unauthorized user-level manipulation of shadow stack pointers while maintaining ease of operation for legitimate OS-controlled context switches.
Data Source
AI summary
Methods and apparatuses relating to switching of a shadow stack pointer are described. In one embodiment, a hardware processor includes a hardware decode unit to decode an instruction, and a hardware execution unit to execute the instruction to: pop a token for a thread from a shadow stack, wherein the token includes a shadow stack pointer for the thread with at least one least significant bit (LSB) of the shadow stack pointer overwritten with a bit value of an operating mode of the hardware processor for the thread, remove the bit value in the at least one LSB from the token to generate the shadow stack pointer, and set a current shadow stack pointer to the shadow stack pointer from the token when the operating mode from the token matches a current operating mode of the hardware processor.