Return-oriented programming protection

A return-oriented programming (ROP) attack protection method, the method comprising:

• providing a region of memory having stored therein a plurality of operation functions, the region of memory set as non-executable;
• responsive to a call to one of the plurality of operation functions and further responsive to at least one predetermined rule, allowing execution of the called operation function;
• and
• after receiving a return from the executed operation function, setting the executed operation function as non-executable,
• wherein the plurality of operation functions comprises the called function and a caller function, the call to the called function received from the caller function,
• wherein the method further comprises:
• responsive to said call, setting the caller function as non-executable;
• and
• responsive to said received return, allowing execution of the caller function, and
• wherein responsive to said at least one predetermined rule, the method further comprises:
• determining whether a return address of said call is valid, said allowance of said execution of the called operation function being responsive to the return address of the call being determined to be valid;
• responsive to the return address of the call being determined to not be valid, not allowing said execution of the called operation function and outputting a notification regarding the non-valid return address.

A return-oriented programming (ROP) attack protection apparatus comprising:

• a processor;
• a first region of memory having stored therein instructions which when read by said processor causes said processor to implement a protection function, said first region of memory set as executable;
• and
• a second region of memory having stored therein instructions which when read by said processor causes said processor to implement a plurality of operation functions, said second region of memory set as non-executable,
• wherein, responsive to a call and further responsive to at least one predetermined rule, said processor is arranged to implement said protection function to:
• allow execution of one of said operation functions;
• and
• set said executed operation function as non-executable after completion of said executed operation function,
• wherein said plurality of operation functions comprises said called function and a caller function, said call to said called function received from said caller function,
• wherein said processor is further arranged to implement said protection function to:
• responsive to said call, set said caller function as non-executable;
• responsive to said received return, allow execution of said caller function,
• wherein responsive to said at least one predetermined rule, said processor is further arranged to implement said protection function to determine whether a return address of said call is valid,
• wherein said allowance of said execution of said called operation function is responsive to said return address of said call being determined to be valid, and
• wherein, responsive to said return address of said call being determined to not be valid, said processor is further arranged to implement said protection function to:
• not allow said execution of said called operation function;
• and
• output a notification regarding the non-valid return address.