Mitigating ROP attacks

Patent metadata

Field	Value
Publication number	US-9665710-B2
Application number	US-201615264672-A
Country	US
Kind code	B2
Filing date	Sep 14, 2016
Priority date	Sep 30, 2015
Publication date	May 30, 2017
Grant date	May 30, 2017

Abstract

Mitigating return-oriented programming attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement “if-then-else return,” sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

First claim

What is claimed is:

1. A computer system for mitigating return-oriented programming (ROP) attacks, the computer system comprising:
one or more computer processors, one or more non-transitory computer-readable storage media, and program instructions stored on one or more of the non-transitory computer-readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
program instructions to receive program code for execution and associated components needed by the program code for execution;
program instructions to load the program code and associated components into memory;
program instructions to select a predetermined number of sequences of machine language instructions from the loaded program code and the associated components, wherein each sequence terminates in a return instruction, and wherein the predetermined number of sequences includes:
machine language instruction sequences that are equivalent to a conditional statement “if-then-else return”;
sequences of machine language instructions corresponding to known malicious code sequences; and
sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences; and
for each selected machine language instruction sequence, program instructions to:
rearrange memory blocks containing the selected machine language instruction sequence, using address space layout randomization (ASLR); then
wait an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks; and
repeat the rearranging at the expiration of the expected time interval;
whereby ROP attacks are mitigated.

Assignees

• IBM

Inventors

• Boehm Omer Y
• Farchi Eitan D
• Margalit Oded
• Shajrawi Yousef
• Vinov Michael

Classifications

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title

• G06F12/0646

  Configuration or reconfiguration · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F3/0623

  in relation to content · CPC title