Shadow Stack Pointer Verification for Fast Return Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods to prevent return-oriented programming (ROP) exploits, such as maintaining shadow stacks, can introduce performance slowdowns and require recompilation or specific processor architectures, and existing solutions do not efficiently manage shadow stacks during privilege transitions.
Innovation Solution
Implementing a processor architecture that includes shadow stack pointers (SSPs) managed through specific registers and verification logic, allowing shadow stacks to be write-protected and verified atomically, with virtualization extensions for efficient token verification, enabling secure shadow stack management without atomic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If shadow stacks are implemented using binary instrumentation to prevent ROP exploits, then security is improved, but processor performance deteriorates due to significant slowdown
Solution Approach 1:
The patent replaces binary instrumentation (software-based monitoring) with hardware-based shadow stack management. The processor includes dedicated shadow stack pointers (SSPs) in registers, verification logic, and atomic write-protection mechanisms that operate at the hardware level, eliminating the performance overhead of software instrumentation while maintaining security.
Solution Approach 2:
The patent introduces shadow stack pointers (SSPs) as intermediary hardware structures that mediate between the legacy stack and security verification. These SSPs store return addresses in a protected manner and enable automatic verification of return addresses without requiring binary instrumentation of the application code.
2Reliability
If shadow stacks are implemented to protect against ROP exploits, then security is improved, but device complexity increases due to additional hardware structures
Solution Approach 1:
The shadow stack pointers (SSPs) serve multiple functions: they store return addresses, provide write-protection verification, enable atomic operations, and support privilege level transitions. This multi-functionality reduces the need for separate dedicated structures for each security function, thereby limiting the increase in overall device complexity.
Solution Approach 2:
The patent merges shadow stack management with existing processor structures by integrating SSPs into the register file and combining verification logic with existing privilege level transition mechanisms. This integration approach minimizes additional complexity by reusing existing hardware resources rather than adding completely separate systems.
3Reliability
If shadow stacks are made write-protected to prevent tampering, then security is improved, but ease of operation deteriorates due to restricted access
Solution Approach 1:
The shadow stack pointers (SSPs) are automatically managed by the processor hardware through self-service mechanisms. The verification logic automatically checks write attempts against the write-protection bits, and privilege level transitions automatically trigger verification of SSP values. This automatic self-verification eliminates the need for manual security checks while maintaining write-protection.
Solution Approach 2:
The patent uses write-protection bits as controllable parameters that can be dynamically changed based on privilege level. When in user mode, the SSPs are write-protected; when transitioning to kernel mode through privileged instructions, the protection is temporarily lifted under verified conditions. This parameter-based control allows flexible access management while maintaining security.
4Reliability
If atomic operations are used for verification of shadow stack pointers, then reliability is improved, but processor performance deteriorates
Solution Approach 1:
The patent extracts the critical verification function from general-purpose atomic operations and implements it as dedicated hardware logic specifically for shadow stack pointer verification. This specialized verification logic operates in parallel with normal instruction execution and does not require acquiring locks or performing costly atomic memory operations, thereby maintaining verification reliability without the performance penalty of general atomic operations.
Data Source
Figure 1A
Figure 1B
Figure 2A~2C
AI summary
An apparatus and method for efficiently managing shadow stacks. For example, one embodiment of a processor comprises: a plurality of registers to store a plurality of shadow stack pointers (SSPs), each SSP associated with a different event priority; event processing circuitry to select a first SSP of the plurality of SSPs from a first register of the plurality of registers responsive to receipt of a first event associated with a first event priority level, the first SSP usable to identify a top of a first shadow stack; verification and utilization checking circuitry to determine whether the first SSP has been previously verified, wherein if the first SSP has not been previously verified then initiating a set of atomic operations to verify the first SSP and confirm that the first SSP is not in use, the set of atomic operations using a locking operation to lock data until the set of atomic operations are complete, and wherein if the first SSP has been previously verified, then reverifying the first SSP and confirming that the first SSP is not in use without using the locking operation.