Software Defined Randomization for Runtime Memory Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security models are vulnerable to return-oriented programming buffer overflow attacks, where attackers can gain control of a program by calling functions within it, violating the assumption that a program is its only user.
Innovation Solution
The implementation of software-defined randomization, specifically through the RunRand library, which allocates new runtime memory segments, copies shared libraries, updates function pointers, and overwrites original memory locations, preventing attackers from controlling the program by continually rerandomizing function addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If functions are stored at fixed memory addresses, then program execution is efficient and simple, but attackers can exploit known addresses to gain control through return-oriented programming attacks
Solution Approach 1:
The patent implements dynamic address randomization by periodically relocating shared libraries to new memory segments and updating function pointers at runtime. This makes memory addresses dynamic rather than static, preventing attackers from exploiting known addresses while maintaining efficient program execution through automated pointer updates.
Solution Approach 2:
The system performs preliminary randomization of memory segments before program execution or before potential attacks. By pre-randomizing addresses and updating all necessary function pointers in advance, the system ensures that even if an attacker obtains information about the program structure, the actual execution addresses remain unpredictable and secure.
2Reliability
If shared libraries are relocated to new memory segments, then attackers cannot exploit known function addresses, but function pointers must be updated which increases processing overhead
Solution Approach 1:
The patent implements periodic randomization where shared libraries are relocated and function pointers are updated at predetermined intervals or triggers during program execution. This periodic action balances security (by frequently changing addresses to prevent exploitation) with performance (by not requiring continuous updates), allowing the system to maintain high execution speed between randomization events.
3Reliability
If randomization code is injected into runtime memory, then function addresses are continually rerandomized preventing attacker control, but memory manipulation operations increase system complexity
Solution Approach 1:
The randomization system is implemented as self-service through automatic detection and handling of shared library loading. The endpoint module automatically detects when shared libraries are loaded, injects randomization code, and manages the relocation and pointer updates without requiring manual intervention or complex external coordination, thereby enforcing the authorization policy while managing complexity internally.
Data Source
AI summary
Various embodiments of an apparatus, methods, systems and computer program products described herein are directed to detecting initiation of one or more shared libraries being loaded into a runtime memory of an application. While the one or more shared libraries are being loaded into the runtime memory, randomization code is placed into the runtime memory. For each respective shared library loaded into the runtime memory: randomization code allocates a new segment of runtime memory. The randomization code inserts a copy of the shared library into the new segment of runtime memory and overwrites a current segment of runtime memory at which the shared library is currently stored.