US 10,540,524 B2 · Memory access protection using processor transactional memory support

Abstract

Technologies for detecting unauthorized memory accesses include a computing device with a processor having transactional memory support. The computing device executes a security assistance thread that starts a transaction using the transactional memory support. Within the transaction, the security assistance thread writes arbitrary data to one or more monitored memory locations. The security assistance thread waits without committing the transaction. The security assistance thread may loop endlessly. The transactional memory support of the computing device detects a transactional abort caused by an external read of the monitored memory location. The computing device analyzes the transactional abort and determines whether a security event has occurred. The computing device performs a security response if a security event has occurred. The monitored memory locations may include memory-mapped operating system libraries, kernel data structures, executable images, or other memory structures that may be scanned by malicious software. Other embodiments are described and claimed.

Claims18

Dependent claims

A computing device comprising:

a security assistance thread module to execute a security assistance thread, the security assistance thread to:
start a transaction using transactional memory support;
within the transaction, write dummy data to a monitored memory location, the monitored memory location to be monitored for attempted unauthorized memory access;
and
enter an endless wait loop without committing the transaction, the transaction to trigger a transactional abort in response to a read of the monitored memory location, the read initiated externally from the transaction;
and
detect the transactional abort of the transaction;
and
a security response module to, in response to the detecting of the transactional abort:
(i) determine whether the read of the monitored memory location is caused by malware, and (ii) when the read is determined to be caused by malware, perform at least one of:
(a) terminate a software program containing the malware, (b) generate a report, or (c) halt the computing device.

8 more elements

One or more computer readable storage devices or storage disks comprising a plurality of instructions that, when executed, cause at least one processor to at least:

spawn a security assistance thread, the security assistance thread to start a transaction without committing the transaction, the transaction using transactional memory support, the transaction to include a write to a monitored memory location, the monitored memory location to be monitored for attempted unauthorized memory accesses, the transaction to trigger a transactional abort in response to a read of the monitored memory location, the read generated by instructions executing outside of the security assistance thread;
in response to the transactional abort, determine whether the read of the monitored memory location was caused by malicious instructions;
and
in response to determining that the read of the monitored memory location was caused by the malicious instructions, at least one of:
(a) terminate a software program associated with the malicious instructions, (b) generate a report, or (c) halt a computing device.

2 more elements

Dependencies are inferred from the claim text.

Memory access protection using processor transactional memory support

Life of this patent

Memory access protection using processor transactional memory support

Life of this patent

Abstract

Claims18