# US 11,308,214 B2 · Binary translation for hardened software security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,214 B2 - Document ID: US11308214B2 - Status: Granted - Kind: B2 - Application number: 16/236,177 - Filed: 2018-12-28 - Published: 2020-07-02 - Granted: 2022-04-19 - Earliest claimed: 2018-12-28 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Ittai Anati; Stanley Gambarin - Web page: https://patentgrep.com/patent/US11308214B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/629: {to features or functions of an application} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Processors in computerized systems can be targeted by hostile actors seeking to bypass security policies and may employ published or otherwise known vulnerabilities. Embodiments may include security subsystems and methods of operation that identify known vulnerabilities during execution and implement countermeasures or enforce security policies. ## Claims ### Claim 1 A processor comprising: a native code subsystem comprising circuitry operable to execute a first instruction set, wherein the first instruction set is in a native code to the processor; a binary translation subsystem comprising circuitry operable to translate the first instruction set to a second instruction set, wherein the second instruction set is a processor internal code representation of the first instruction set; and a security subsystem comprising a security data structure that comprises a set of fix up target patterns and a set of countermeasures, wherein each fix up target pattern of the set of fix up target patterns comprises an instruction sequence, and wherein the security subsystem: parses the second instruction set to detect a sequence of a subset of the second instruction set that corresponds to an instruction sequence of a fix up target pattern of the set of fix up target patterns of the security data structure prior to execution by the native code subsystem; implements a countermeasure of the set of countermeasures of the security data structure associated with the fix up target pattern into the second instruction set; and performs the second instruction set in the native code subsystem or the binary translation subsystem, following implementation of the countermeasure. ### Claim 2 (depends on 1) The processor of claim 1, wherein the security subsystem is to parse the first instruction set. ### Claim 3 (depends on 1) The processor of claim 1, wherein parsing the second instruction set comprises assembling a data dependency graph or a flow graph associated with the second instruction set and using the data dependency graph or the flow graph to parse the second instruction set. ### Claim 4 (depends on 1) The processor of claim 1, wherein the set of fix up target patterns comprise a plurality of fix up target patterns and the set of countermeasures comprise a plurality of countermeasures, wherein each fix up target pattern of the plurality of fix up target patterns is associated with at least one countermeasure of the plurality of countermeasures. ### Claim 5 (depends on 4) The processor of claim 4, wherein parsing the second instruction set comprises comparing the second instruction set with the plurality of fix up target patterns of the security data structure. ### Claim 6 (depends on 1) The processor of claim 1, wherein parsing the second instruction set comprises performing at least one of pattern matching, identity matching, and a signature matching. ### Claim 7 (depends on 1) The processor of claim 1, wherein the fix up target pattern comprises a speculative execution vulnerability or an out-of-order execution vulnerability. ### Claim 8 (depends on 1) The processor of claim 1, wherein the countermeasure comprises an addition of a serialization instruction. ### Claim 9 (depends on 1) The processor of claim 1, wherein the second instruction set is binary translation representation of the first instruction set. ### Claim 10 A method comprising: receiving, by a native code subsystem of a processor, a sequence of instructions in a native instruction set using a native code to the processor; translating, by a binary translation subsystem of the processor, the sequence of instructions from the native instruction set to a processor internal code instruction set; identifying, by a security subsystem of the processor, a vulnerability in the translated sequence of instructions in the processor internal code instruction set by comparing the translated sequence of instructions with an instruction sequence of each fix up target pattern of a first set of fix up target patterns of a security data structure, wherein the vulnerability is associated with a fix up target pattern of the first set of fix up target patterns; and implementing, by the security subsystem, a countermeasure associated with the vulnerability, wherein the security data structure associates the countermeasure with the fix up target pattern. ### Claim 11 (depends on 10) The method of claim 10, wherein the sequence of instructions is received in the native instruction set and the fix up target pattern is represented in the processor internal code instruction set. ### Claim 12 (depends on 10) The method of claim 10, wherein the fix up target pattern is represented in the binary translation. ### Claim 13 (depends on 10) The method of claim 10, wherein implementing the countermeasure comprises adding a countermeasure instruction for execution prior to executing the sequence of instructions or the translated sequence of instructions, wherein the countermeasure instruction is associated with the countermeasure. ### Claim 14 (depends on 13) The method of claim 13, wherein the countermeasure instruction comprises a serializing instruction. ### Claim 15 (depends on 10) The method of claim 10, comprising receiving an update to the security data structure comprising a second set of fix up target patterns. ### Claim 16 A system comprising: a memory device comprising machine-readable instructions; and a processor to execute the machine-readable instructions, wherein the processor comprises a security data structure comprising a first set of fix up target patterns and a first set of countermeasures, wherein each fix up target pattern of the first set of fix up target patterns comprises an instruction sequence, and wherein each fix up target pattern of the first set of fix up target patterns is associated with at least one countermeasure of the first set of countermeasures, and wherein the processor is configured to: translate the machine readable instructions from a native instruction set to a processor internal code representation of the machine readable instructions; find at least one instruction sequence of at least one fix up target pattern of the first set of fix up target patterns of the security data structure in a sequence of the processor internal code representation of the machine-readable instructions prior to execution; and implementing a countermeasure of the first set of countermeasures of the security data structure, wherein the countermeasure is associated with the at least one fix up target pattern. ### Claim 17 (depends on 16) The system of claim 16, wherein the processor is configured to: receive security updates comprising a second set of fix up target patterns and a second set of countermeasures; and add the second set of fix up target patterns and the second set of countermeasures to the security data structure. ### Claim 18 (depends on 17) The system of claim 17, wherein the security updates are received over a network connection. ### Claim 19 (depends on 16) The system of claim 16, comprising a binary translation subsystem configured to translate the machine-readable instructions from the native instruction set to the processor internal code representation of the machine readable instructions using a binary translation, and wherein the first set of fix up target patterns corresponds to binary translation representations. ### Claim 20 (depends on 16) The system of claim 16, wherein the first set of fix up target patterns comprises a speculative execution vulnerability pattern, and wherein at least one countermeasure associated with the speculative execution vulnerability pattern comprises an insertion of a serializing instruction.