Signed Bounded Pointer Signing Operation for Control Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems face challenges in effectively preventing control flow integrity (CFI) attacks, where malicious tasks can manipulate bounded pointers to subvert the intended flow of a computer program, despite the use of range information to constrain memory addresses.
Innovation Solution
Implementing a signing operation on bounded pointers to generate signed bounded pointers, which include a signature within the pointer value and associated attributes, thereby restricting unauthorized use and enhancing security by ensuring only entities with access to the original information can utilize these pointers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bounded pointers with range information are used to constrain memory addresses, then security against unauthorized access is improved, but control flow integrity attacks can still subvert the intended flow of control by manipulating return addresses within the allowable range
Solution Approach 1:
The patent applies preliminary action by performing a signing operation on bounded pointers before they are used to store return addresses. This signing process embeds cryptographic signatures and signing information into the pointer attributes in advance, creating a trusted state that prevents subsequent unauthorized manipulation. When a return address is pushed onto the stack, it is signed with cryptographic information including a signature generated from the pointer value and signing attributes, ensuring that any later attempts to subvert control flow will be detected during the unsigning operation.
Solution Approach 2:
The patent introduces an intermediary mechanism by adding signing information as a separate layer of protection between the bounded pointer and the control flow execution. This signing information acts as a mediator that verifies the integrity of return addresses before they are used for branching. The signing operation embeds cryptographic signatures that serve as an intermediary verification layer, allowing the system to distinguish between authorized and unauthorized modifications to control flow pointers without changing the fundamental bounded pointer structure.
2Reliability
If signing operations are performed on bounded pointers to prevent unauthorized modifications, then control flow integrity is enhanced, but device complexity increases due to additional signing information storage and verification operations
Solution Approach 1:
The patent merges the signing information with the existing bounded pointer structure by integrating cryptographic signatures and signing attributes directly into the pointer's attribute fields. Rather than creating separate verification structures, the signing information is combined with the range information and other pointer metadata, allowing verification to occur within the existing pointer handling infrastructure. This merging reduces the need for separate complex verification systems while maintaining security.
Solution Approach 2:
The patent implements self-service by designing the signing mechanism to automatically verify its own integrity through cryptographic signatures embedded in the pointer attributes. The signing information contains sufficient data for the system to self-verify the authenticity and integrity of return addresses without requiring external verification infrastructure. The unsigning operation automatically checks the signature against the embedded signing information, enabling the system to service its own security requirements without additional complex external verification mechanisms.
Data Source
AI summary
An apparatus and method are provided for controlling use of bounded pointers. The apparatus includes storage to store bounded pointers, where each bounded pointer comprises a pointer value and associated attributes, with the associated attributes including range information indicative of an allowable range of addresses when using the pointer value. Processing circuitry is used to perform a signing operation on an input bounded pointer in order to generate an output bounded pointer in which a signature generated by the signing operation is contained within the output bounded pointer in place of specified bits of the input bounded pointer. In addition, the associated attributes include signing information which is set by the processing circuitry within the output bounded pointer to identify that the output bounded pointer has been signed. Such an approach provides increase resilience to control flow integrity attack when using bounded pointers.