Patent Description:
The <CIT> and the non-patent literature XP047043728: "Systematic Analysis of Defenses against Return-Oriented Programming" by Skowyra Richard et a1 are considered relevant prior art. Return-Oriented Programming is a computer hacking technique.

It is a computer security exploit technique that allows an attacker to execute code in the presence of security defences such as non-executable memory and code signing.

In this technique, an attacker gains control of the call stack to hijack program control flow and then executes carefully chosen machine instruction sequences, called gadgets. Each gadget typically ends in a return instruction and is located in a subroutine within the existing program and/or shared library code. Chained together, these gadgets allow an attacker to perform arbitrary operations on a machine employing defences that thwart simpler attacks.

There are some attempts on a software basis, to prevent a return oriented programming for computer systems by defeating return-oriented rootkits like return-less kernels, which uses techniques like return indirection, register allocation and peephole optimization. Those techniques are often slowing down computer systems speed by around <NUM>% to <NUM>%.

As highly automated driving and autonomous driving becomes more and more important in future automobiles, there is a need for data security and intrusion protection, in order to avoid hacking of automobiles. In highly automated and autonomous vehicles the computer system speed is another critical point, as many tasks have to be proceeded in real-time, in order to allow such vehicles a safe driving.

Therefore, there may be a need for computer systems which disallow a return oriented programming, without significant system speed loss and/or which may provide at least one other advantage over the current state of the art.

According to a first aspect of the invention there is provided a method for avoiding a return oriented programming attempt on a computer, the method comprising: initial processing of a set of instructions. Therein, the set of instructions comprises a first kind of instructions and a second kind of instructions. And the initial processing of the set of instructions comprises: storing at least a part of each first kind of instruction within the set of instructions into a first computer memory. Storing at least a part of each second kind of instruction within the set of instructions into a second computer memory. Storing a storing reference into the first computer memory, for each stored second kind of instruction within the second computer memory. Therein, each respective storing reference indicates a storing address of each respective stored second kind of instruction within the second computer memory. And locking the second computer memory, for disallowing a write access to the second computer memory, after a termination of the initial processing of the set of instructions.

Some or all steps of the method may be executed in an automated way by means for automatisation such as computer means.

An initial processing according to the invention may be a first execution of a set of instructions after the set of instructions is loaded into a hardware memory and provided for execution.

A set of instructions according to the invention may be for example a computer program for being executed on a computer. In particular the set of instructions is arranged for being executed on an operation system level.

A first kind of instructions according to the invention may comprise the program instructions itself, like procedures, loops, methods, objects and the like.

A second kind of instructions according to the invention may comprise the return addresses of the set of instructions. In particular it may comprise the return addresses of the first kind of instructions.

A locking the second computer memory according to the invention may comprise a locking method, which cannot be bypassed at an operation system level, for example by a software instruction on an operation system level. In particular the locking of the second computer memory cannot by bypassed by any direct software instruction as soon as a locking command has been sent, in order to lock the second computer memory in a way, that it cannot be over-written. In the case the locking of the second computer memory cannot by bypassed by any direct software instruction, the second computer memory can only be transferred into a write-access mode again, by interrupting an electrical power-supply to the second computer memory for a certain period of time. And in this case, for example, an indirect software instruction may lead to a transferring the second computer memory into a write-access mode. Such an indirect software instruction may be an instruction to hardware-reset the second computer memory. In particular, the second computer memory shall loose all its stored information after the lapse of the certain period of time.

This aspect of the invention is based on the idea that it may be advantageous to disallow a re-writing of a certain part of a computer system memory by a software instruction, in order to prevent a manipulation of the memory storing the return addresses of the set of instructions. This may also prevent a significant computer system speed loss.

According to a further aspect of the invention there is provided a computer processing device, comprising: a second computer memory, and a processing unit. Therein, the processing unit comprises: an initial processing means, for initial processing of a set of instructions. Therein, the set of instructions comprises a first kind of instructions and a second kind of instructions. A first storing means, for storing at least a part of each first kind of instruction within the set of instructions into a first computer memory. A second storing means, for storing at least a part of each second kind of instruction within the set of instructions into the second computer memory. A third storing means, for storing a storing reference into the first computer memory, for each stored second kind of instruction within the second computer memory. Therein, each respective storing reference indicates a storing address of each respective stored second kind of instruction within the second computer memory. And a locking means, for locking the second computer memory, for disallowing a write access to the second computer memory, after a termination of the initial processing of the set of instructions. And therein, the computer processing device is adapted for executing a method according to the invention.

This aspect of the invention is based on the idea that it may be advantageous to provide a dedicated hardware, in order to disallow a re-writing of a certain part of a computer system memory by a software instruction, in order to prevent a manipulation of the memory storing the return addresses of the set of instructions.

According to a further aspect of the invention there is provided a computer, comprising.

This aspect of the invention is based on the idea that it may be advantageous to provide a computer system, in order to disallow a re-writing of a certain part of a computer system memory by a software instruction, in order to prevent a manipulation of the memory storing the return addresses of the set of instructions.

According to a further aspect of the invention there is provided a vehicle comprising a computer according to the invention.

This aspect of the invention is based on the idea that it may be advantageous to provide a vehicle with a certain computer system, in order to disallow a re-writing of a certain part of a computer system memory by a software instruction, in order to prevent a manipulation of the memory storing the return addresses of the set of instructions.

According to a first embodiment of the invention, locking the second computer memory comprises sending a read only allowance command to a control circuit of the second computer memory.

A control circuit according to the invention may an electrical circuit, adapted for controlling the behaviour of a computer memory.

This embodiment of the invention is based on the idea that it may be advantageous to provide a dedicated hardware for controlling the behaviour of the second computer memory. This may increase the processing speed. This may also reduce the production cost. This may lead to a higher reliability of the system. This may further hinder a hacking attempt on the system.

According to a further embodiment of the invention, initial processing of the set of instructions comprises processing each instruction of the set of instructions in a first come first serve modality.

A first come first serve modality according to the invention may comprise processing each instruction after another.

This embodiment of the invention is based on the idea that it may be advantageous to process each step of the set of instructions one after another, in order to increase processing speed, as less other instructions may be needed.

According to a further embodiment of the invention, storing the respective storing reference into the first computer memory is carried out at a time the respective second kind of instruction is processed.

This embodiment of the invention is based on the idea that it may be advantageous to proceed the storing of the respective storing reference as soon as possible, in order to avoid a system speed loss.

According to a further embodiment of the invention, the first computer memory and/or the second computer memory is accessed in a first in first out modality.

This embodiment of the invention is based on the idea that it may be advantageous to provide a memory that may act as a stack for a quick and easy access on its stored information. This may increase the processing speed. This may also reduce the production cost.

According to a further embodiment of the invention, the set of instructions is marked as return oriented programming safe.

Therefore, for example, the method may only be executed, if the set of instructions is marked as return oriented programming safe.

This embodiment of the invention is based on the idea that it may be advantageous to only proceed return oriented programming safe marked computer code in a return oriented programming safe way, as not all computer code may be optimised for such a proceeding and splitting of code respectively instructions.

According to a further embodiment of the invention, initial processing of the set of instructions is carried out on an operating system level.

This embodiment of the invention is based on the idea that it may be advantageous to prevent a return oriented programming hack in particular on an operating system level, as most hacking attacks may occur on such a level. Therefore, this may further hinder a hacking attempt on the system.

According to a further embodiment of the invention, the set of instructions is part of a computer program. Preferably, the set of instructions is part of a compiled computer program.

This embodiment of the invention is based on the idea that it may be advantageous to provide a return oriented program free solution for a complete computer program. This may further hinder a hacking attempt on the system.

According to a further embodiment of the invention, the method moreover comprises a control circuit. Therein, the control circuit is adapted for changing an access to the second computer memory from a write access to a read only access. For example, the changing of the access from a write access to a read only access, may be executed on a command from the computer processing device respectively from the processing unit.

This embodiment of the invention is based on the idea that it may be advantageous to use a hardware lock for locking the computer memory in order to further hinder a hacking attempt on the system.

According to a further embodiment of the invention, the second computer memory is encapsulated from an operating system level in such a manner that the second computer memory is not directly accessible from the operating system level. Preferably the second computer memory is not visible from the operating system.

This embodiment of the invention is based on the idea that it may be advantageous to prevent a software access on the locking mechanism in order to further hinder a hacking attempt on the system.

According to a further embodiment of the invention, the second computer memory and the control circuit are both arranged on a same hardware unit.

For example, the second computer memory may comprise the control circuit.

This embodiment of the invention is based on the idea that it may be advantageous to integrate the locking mechanism together with the respective computer memory. This may increase the processing speed. This may also reduce the production cost. This may lead to a higher reliability of the hardware device.

According to a further embodiment of the invention, the second computer memory and the processing unit are both arranged on a same hardware unit.

Therefore, also the control circuit may be arranged on the same hardware unit.

For example, the second computer memory and the control circuit may be arranged together on a same integrated circuit.

For example, the second computer memory, the control circuit and the processing unit may be arranged together on a same integrated circuit.

This embodiment of the invention is based on the idea that it may be advantageous to integrate the processing unit together with the respective computer memory. This may increase the processing speed. This may also reduce the production cost. This may lead to a higher reliability of the hardware device.

According to a further embodiment of the invention, the first computer memory is adapted for allowing a random access to the first computer memory.

This embodiment of the invention is based on the idea that it may be advantageous to use a common computer memory as the first memory in order to reduce production costs.

According to a further embodiment of the invention, the second computer memory differs from the first computer memory in at least one physical characteristic concerning a storage characteristics.

This embodiment of the invention is based on the idea that it may be advantageous to use a different kind of memory type for the second memory, in order to further hinder a hacking attempt on the system.

Thus, the first computer memory stores Input and Output Parameters to the function, while the second computer memory stores the return address of the function.

The return address shall be only written to the second memory after execution of specific instructions such as CALL and not by means of instructions such as PUSH or MOV. This means the second computer memory is only writable by CALL or such privileged instruction and not by others. And hence, to the caller this second computer memory is invisible or read-only, thus not writable at all.

Moreover, the location where the code respectively the instructions are stored may also be accessible as read-only, otherwise a hacker can for example write a CALL instruction to the code memory and go where he wants to.

It should be noted that the term "comprising" does not exclude other elements or steps and the use of articles "a" or "an" does not exclude a plurality. It should also be noted that reference signs in the claims should not be construed as limiting the scope of the claims.

It has to be noted that embodiments of the invention have been described with reference to different subject matters. In particular, some embodiments have been described with reference to method type claims whereas other embodiments have been described with reference to apparatus type claims. However, a person skilled in the art will gather from the above and the following description that, unless other notified, in addition to any combination of features belonging to one type of subject matter also any combination between features relating to different subject matters, in particular between features of the method type claims and features of the apparatus type claims is considered as to be disclosed with this document.

The illustration in the drawing is schematically. It is noted that in different figures, similar or identical elements or features are provided with the same reference signs or with reference signs, which are different from the corresponding reference signs only within the first digit. In order to avoid unnecessary repetitions, elements or features, which have already been elucidated with respect to a previously described embodiment, are not elucidated again at a later position of the description.

The following figures shall assist in a deeper understanding of the claimed invention. Therein the figures show exemplary:.

<FIG> shows a schematical illustration of a proposed method according to an exemplary embodiment of the invention.

Therein, <FIG> shows a Method for avoiding a return oriented programming attempt on a computer <NUM> (not illustrated in <FIG>), the method comprising: Initial processing <NUM> of a set of instructions <NUM>. Therein, the set of instructions <NUM> comprises a first kind of instructions <NUM> and a second kind of instructions <NUM>. And the initial processing <NUM> of the set of instructions <NUM> comprises: storing <NUM> at least a part of each first kind of instruction <NUM> within the set of instructions <NUM> into a first computer memory <NUM>. Storing <NUM> at least a part of each second kind of instruction <NUM> within the set of instructions <NUM> into a second computer memory <NUM>. Storing <NUM> a storing reference <NUM> into the first computer memory <NUM>, for each stored <NUM> second kind of instruction <NUM> within the second computer memory <NUM>. Therein, each respective storing reference <NUM> indicates a storing-address <NUM> of each respective stored <NUM> second kind of instruction <NUM> within the second computer memory <NUM>. And locking <NUM> the second computer memory <NUM>, for disallowing a write-access to the second computer memory <NUM>, after a termination of the initial processing <NUM> of the set of instructions <NUM>.

<FIG> shows a schematical illustration of a proposed device according to a further exemplary embodiment of the invention.

<FIG> shows a computer processing device <NUM>, comprising: A second computer memory <NUM> and a processing unit <NUM>. Therein, the processing unit <NUM> comprises: An initial processing means <NUM>, for initial processing <NUM> of a set of instructions <NUM>. Therein, the set of instructions <NUM> comprises a first kind of instructions <NUM> and a second kind of instructions <NUM>. A first storing means <NUM>, for storing <NUM> at least a part of each first kind of instruction <NUM> within the set of instructions <NUM> into a first computer memory <NUM>. A second storing means <NUM>, for storing <NUM> at least a part of each second kind of instruction <NUM> within the set of instructions <NUM> into the second computer memory <NUM>. A third storing means <NUM>, for storing <NUM> a storing reference <NUM> into the first computer memory <NUM>, for each stored <NUM> second kind of instruction <NUM> within the second computer memory <NUM>. Therein, each respective storing reference <NUM> indicates a storing-address <NUM> of each respective stored <NUM> second kind of instruction <NUM> within the second computer memory <NUM>. And a locking means <NUM>, for locking <NUM> the second computer memory <NUM>, for disallowing a write-access to the second computer memory <NUM>, after a termination of the initial processing <NUM> of the set of instructions <NUM>. And therein, the computer processing device <NUM> is adapted for executing a method according to the invention.

Moreover, the computer processing device <NUM> comprises a control circuit <NUM>. Therein, the control circuit <NUM> is adapted for changing an access to the second storage <NUM> from a write access to a read only access. Thus, the locking means <NUM> may send a locking command <NUM> to the control circuit <NUM>, in order to disallow a write-access to the second computer memory <NUM>.

<FIG> shows a computer <NUM>, comprising a first computer memory <NUM> and a computer processing device <NUM> according to the invention. Therein, the first computer memory <NUM> is adapted for allowing a random access to the first computer memory <NUM>. And the second computer memory <NUM> differs from the first computer memory <NUM> in at least one physical characteristic concerning a storage characteristics.

<FIG> shows a schematical illustration of a proposed vehicle according to a further exemplary embodiment of the invention.

<FIG> shows a Vehicle <NUM> comprising a computer <NUM> according to the invention.

In order to recapitulate the above described embodiments of the present invention one can state:
The claimed invention allows for providing a special kind of memory, similar to a Random Access Memory (RAM), for storing all return addresses.

Claim 1:
Method for avoiding a return oriented programming attempt on a computer (<NUM>), the method comprising:
- Initial processing (<NUM>) of a set of instructions (<NUM>), wherein the set of instructions (<NUM>) comprises machine code, and wherein the set of instructions (<NUM>) comprises a first kind of instructions (<NUM>) comprising program instructions and a second kind of instructions (<NUM>) comprising a return address of the respective first kind of instructions (<NUM>), and wherein the initial processing (<NUM>) of the set of instructions (<NUM>) comprises:
- Storing (<NUM>) at least a part of each first kind of instruction (<NUM>) within the set of instructions (<NUM>) into a first computer memory (<NUM>),
- Storing (<NUM>) at least a part of each second kind of instruction (<NUM>) within the set of instructions (<NUM>) into a second computer memory (<NUM>), the second computer memory beeing a dedicated memory, for only storing return addresses,
- Storing (<NUM>) a storing reference (<NUM>) into the first computer memory (<NUM>), for each stored (<NUM>) second kind of instruction (<NUM>) within the second computer memory (<NUM>), wherein each respective storing reference (<NUM>) indicates a storing-address (<NUM>) of each respective stored (<NUM>) second kind of instruction (<NUM>) within the second computer memory (<NUM>), and
- Locking (<NUM>) the second computer memory (<NUM>), for disallowing a write-access to the second computer memory (<NUM>), after a termination of the initial processing (<NUM>) of the set of instructions (<NUM>), wherein the locking (<NUM>) of the second computer memory (<NUM>) can only be lifted by interrupting an electrical power-supply to the second computer memory (<NUM>) for a certain period of time, wherein after this certain period of time without electrical power-supply, the at least part of each second kind of instruction (<NUM>) stored within the second computer memory (<NUM>) is erased.