Type-Based Self-Assembling Indirect Control Flow Graph for Dynamic Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for generating an indirect control flow graph (ICFG) are inefficient and unable to scale to complex software like entire operating systems or web browsers, and they require static linking or cannot operate in dynamically loaded code environments, leading to incomplete or incorrect ICFGs that may result in security vulnerabilities and performance issues.
Innovation Solution
The development of a type-based self-assembling indirect control flow graph (TB-SA-ICFG) system that generates an ICFG without analyzing all code, including dependent libraries, and can operate in dynamically loaded code environments, using tag-based classification to convert indirect control transfers into direct transfers, reducing performance impact and enhancing security by providing fine-grained control flow integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional methods are used to generate an indirect control flow graph (ICFG), then the ICFG can be constructed using traditional analysis techniques, but the methods are inefficient and unable to scale to complex software like entire operating systems or web browsers
Solution Approach 1:
The patent segments the ICFG generation process by introducing a type-based classification system that divides functions into categories (e.g., control flow functions, data processing functions). This segmentation allows the system to handle complex software by processing functions in manageable groups rather than requiring complete static analysis of the entire codebase, enabling scalability to operating systems and web browsers.
Solution Approach 2:
The patent implements a dynamic ICFG generation approach where the control flow graph is constructed and refined during runtime based on actual execution paths. Instead of requiring complete static analysis beforehand, the system dynamically adapts the ICFG as the program executes, allowing it to scale to complex software while maintaining accuracy for the actually executed portions of the code.
2Adaptability or versatility
If conventional methods are used to generate an ICFG, then traditional analysis can be applied, but static linking is required or the system cannot operate in dynamically loaded code environments
Solution Approach 1:
The patent makes the ICFG generation process dynamic by allowing the control flow graph to be constructed during runtime as code is loaded and executed. The system maintains type information and classification data that enable ICFG construction without requiring static linking, allowing the program to operate in dynamically loaded code environments where code is loaded and linked at runtime rather than during compilation.
Solution Approach 2:
The patent introduces type-based classification information as an intermediary layer between the code and the ICFG generation process. This intermediary layer provides sufficient information to construct the control flow graph without requiring complete static analysis or static linking, enabling the system to work with dynamically loaded code while maintaining the necessary control flow information for security and optimization purposes.
3Reliability
If conventional ICFG generation methods are used, then traditional analysis techniques can be applied, but the resulting ICFGs may be incomplete or incorrect leading to security vulnerabilities and performance issues
Solution Approach 1:
The patent performs preliminary type-based classification and tagging of functions during compilation or code generation, before the actual ICFG construction. This preliminary action assigns type information and classification data to functions that enables accurate ICFG generation later without requiring complete re-analysis of the code, ensuring reliability while maintaining scalability to large codebases.
Solution Approach 2:
The patent implements feedback mechanisms where the ICFG generation process uses runtime execution information to refine and verify the control flow graph. By comparing actual execution paths against the generated ICFG and using type-based classification feedback, the system ensures the accuracy and completeness of the ICFG while maintaining scalability through selective refinement of only the necessary portions of the control flow graph.
Data Source
AI summary
Using various embodiments, methods and systems for computing a self-assembling indirect control flow graph based on one or more function types and function pointer types are described. In one embodiment the indirect control flow graph is computed by finding one or more function types and function pointer types in source code and/or binary code, computing one or more identifier tags for each type, classifying functions and function pointers based on the computed tags. In one embodiment, the classification tags can be used in a tag check based Control Flow Integrity system. In another embodiment, the classification tags can be used to convert indirect function calls into direct function calls. Yet in another embodiment, tag checks can be eliminated in a Control Flow Integrity system.