Stack Segmentation for Overflow Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Stack overflow attacks, where a program writes data beyond the intended stack structure, potentially overwriting return addresses with attacker-controlled data or code, pose a significant security threat in programming languages like C, C++, and Java.
Innovation Solution
Implementing a system that allocates separate memory portions for general and secure stacks, classifying execution items, and using unique access keys to authenticate and manage stack operations, thereby preventing unauthorized overflows and protecting against stack-based attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single stack is used to store all execution items, then the system is simple and easy to manage, but it becomes vulnerable to stack overflow attacks where attacker-controlled data can overwrite return addresses
Solution Approach 1:
The patent divides the single stack into two separate stacks: a first stack for storing return addresses and a second stack for storing other execution items. This segmentation isolates critical return address data from potential overflow attacks, allowing the system to maintain security while managing complexity through structured separation of concerns
2Adaptability or versatility
If extendable length data is stored in the stack, then the data structure is flexible and adaptable, but it enables stack overflow attacks by allowing writes beyond intended boundaries
Solution Approach 1:
The patent separates extendable length data storage into a dedicated second stack, isolated from the first stack that stores return addresses. This allows extendable data to maintain its flexibility and adaptability while preventing it from overflowing into critical regions, thus eliminating the security vulnerability
Solution Approach 2:
The patent applies different security characteristics to different parts of the stack structure. The first stack is designed with protection against overflow for storing critical return addresses, while the second stack allows extendable data with appropriate boundaries. This local differentiation of security properties enables flexibility where needed while maintaining security where critical
3Reliability
If separate stacks are allocated for different classes of execution items, then security against overflow attacks is improved, but memory usage and system complexity increase
Solution Approach 1:
The patent implements segmentation of the stack into two portions, but both stacks reside within the same overall stack memory structure. This approach provides the security benefits of separation while avoiding the memory overhead of completely separate stack structures, as the total memory allocation remains optimized for the combined needs of both stacks
Data Source
AI summary
A computer processor receives a plurality of execution items corresponding to a computer process. The computer processor allocates a first memory portion corresponding to a first stack, wherein the first stack corresponds to a first class of execution items. The computer processor allocates a second memory portion corresponding to a second stack, wherein the second stack corresponds to a second class of execution items. The computer processor identifies a first execution item of the plurality of execution items and determining a class corresponding to the first execution item.