Shadow Stack Flow Integrity Against ROP Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing advanced driver assistance systems (ADAS) and autonomous vehicle (AV) systems lack robust protection against return-oriented programming attacks, which can manipulate the vehicle's control flow and compromise safety.
Innovation Solution
Implement a system that includes a shadow stack mechanism to verify the integrity of the control flow by checking for return-oriented programming attacks, using a shadow environment identifier to ensure the flow follows the original program path, and respond with alerts or system reboots if deviations are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional control flow mechanisms are used in ADAS and AV systems, then the systems can operate with standard processing efficiency, but they become vulnerable to return-oriented programming attacks that can manipulate control flow and compromise safety
Solution Approach 1:
The patent creates a shadow stack that is a copy of the traditional call stack. This shadow stack stores shadow return addresses that are validated before control flow changes are executed. By maintaining this parallel copy structure, the system can verify control flow integrity without fundamentally changing the execution architecture, thus protecting against return-oriented programming attacks while maintaining standard processing efficiency.
Solution Approach 2:
The shadow stack acts as an intermediary layer between the traditional control flow mechanism and the security validation process. Instead of directly modifying control flow instructions, the system uses the shadow stack as a mediator to store and validate return addresses. This intermediary structure allows the system to enforce control flow integrity checks without disrupting the normal execution path or requiring changes to existing code.
2Reliability
If a shadow stack mechanism is implemented to verify control flow integrity, then protection against return-oriented programming attacks is achieved, but the system complexity increases due to additional data structures and validation logic
Solution Approach 1:
The patent segments the control flow validation function into a separate shadow stack structure that operates independently from the traditional call stack. By dividing the validation logic into discrete shadow stack operations (push, pop, validate) that mirror traditional stack operations, the system adds protection functionality without creating complex interdependencies. This segmentation allows the shadow stack to be implemented as a modular addition rather than a complex integration with existing control flow mechanisms.
Data Source
Figure 1~2A
Figure 2B~2D
Figure 2E~3
AI summary
A method for evaluating flow control integrity, the method may include detecting that a flow reached a flow change command or is about to reach the flow change command, wherein the flow change command belongs to a current software environment, wherein the current software environment is identified by a current environment identifier; retrieving a shadow environment identifier that is a last environment identifier stored in a shadow stack, wherein the shadow environment identifier identifies a software environment having an entry region that was a last entry region accessed by the flow, wherein the entry region comprises a shadow stack update instruction that was executed by the flow; comparing the shadow environment identifier to the current environment identifier; and detecting a potential attack when the shadow environment identifier differs from the current environment identifier.