Subroutine Stack Protection via Hardware-Protected Regions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Subroutine stacks in computing systems lack effective protection against security and safety issues, such as stack buffer overflow attacks and unintended manipulations, which can compromise system integrity and interact between subroutines of different security levels.
Innovation Solution
A subroutine stack protection unit that uses address registers to create hardware-protected regions within the stack, preventing unauthorized access and ensuring that each subroutine can only access its allocated memory space, thereby isolating subroutines and maintaining stack integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If subroutine stacks are used to store parameters and return addresses, then subroutine functionality is enabled, but security vulnerabilities such as stack buffer overflow attacks and unintended manipulations occur
Solution Approach 1:
The stack is divided into multiple protected regions, each associated with a specific subroutine or code segment. Each region has its own stack pointer and boundary protections, preventing unauthorized access between different subroutine contexts and eliminating the vulnerability to stack buffer overflow attacks.
Solution Approach 2:
Different protection mechanisms are applied to different regions of the stack based on their security requirements. Critical regions have stronger protection (e.g., read-only attributes, executable bit restrictions) while less critical regions have standard protection, providing targeted security without compromising overall functionality.
2Reliability
If memory protection units are used to provide access restrictions on static memory ranges, then memory protection is achieved, but they cannot protect dynamic subroutine stack boundaries
Solution Approach 1:
The protection mechanism dynamically adjusts stack boundaries and protection attributes based on the current execution context. Stack pointers are automatically updated when subroutines are called or return, and protection attributes (such as read-only or non-executable flags) are dynamically applied to the current stack region, enabling both reliability and adaptability.
Solution Approach 2:
A stack protection unit or intermediary layer is introduced between the subroutine code and the stack memory. This intermediary manages stack boundaries, enforces protection rules, and dynamically adjusts access permissions based on the active subroutine context, bridging the gap between static memory protection and dynamic stack requirements.
3Device complexity
If no protection mechanisms are implemented, then system complexity is reduced, but security and safety problems compromise system integrity
Solution Approach 1:
The protection mechanism is integrated into the processor's existing stack management hardware (stack pointers, stack frame setup/teardown logic). The same hardware that manages stack operations automatically enforces protection boundaries without requiring separate complex protection circuits, minimizing added complexity while maintaining system integrity.
Solution Approach 2:
The protection mechanism serves multiple functions simultaneously: it enables stack overflow detection, prevents unauthorized access to other subroutines' data, enforces security policies (such as non-executable stack), and provides debugging information. This multi-functionality reduces the need for separate protection systems and minimizes overall complexity.
Data Source
AI summary
A protection unit of a subroutine stack accessible by a CPU controlled by one main software program, for storing and removing stack frame(s), the stack protection unit being coupleable to the stack and the CPU, comprising:a processor coupled to a first and a second address register;wherein, when a first stack frame is stored onto the stack and the execution of the main software program is suspended by the CPU due to the execution of a subroutine;the processing unit is adapted to set one access rule based on the first and second address registers, preventing:the ongoing subroutine, from accessing a hardware-protected region of the stack, comprising at least one stack frame associated with a return address from which the main software program resumes execution after termination of the execution of the subroutine.A processor, a method and a computer program are also claimed.