# US 12,111,913 B2 · Core processor and redundant branch processor with control flow attack detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,111,913 B2
- Document ID: US12111913B2
- Status: Granted
- Kind: B2
- Application number: 17/485,436
- Filed: 2021-09-26
- Published: 2023-03-30
- Granted: 2024-10-08
- Earliest claimed: 2021-09-26
- Assignees: Ceremorphic, Inc.
- Applicants: Ceremorphic, Inc.
- Inventors: Lizy Kurian John; Heonchul Park; Venkat Mattela
- Web page: https://patentgrep.com/patent/US12111913B2

## CPC

- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 9/3001: {Arithmetic instructions}
- G06F 9/30058: {Conditional branch instructions}
- G06F 9/30072: {to perform conditional operations, e.g. using predicates or guards}
- G06F 9/30076: {to perform miscellaneous control operations, e.g. NOP}
- G06F 9/3842: {Speculative instruction execution}
- G06F 9/3861: {Recovery, e.g. branch miss-prediction, exception handling (error detection or correction G06F11/00)}
- G06F 9/3885: {using a plurality of independent parallel functional units}
- G06F 21/71: to assure secure computing or processing of information
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A secure processor with fault detection has a core thread which executes with a redundant branch processor thread. In one configuration, the core thread is operative on a fully functional core processor configured to execute a complete instruction set, and the redundant branch processor thread contains only initialization instructions and flow control instructions such as branch instructions and is operative on a redundant branch processor which is configured to execute a subset of the complete instruction set, specifically a branch control variable initialization and a branch instruction, thereby greatly simplifying the redundant branch processor architecture. Fault conditions are detected by comparing either a history of branch taken/not taken and branch targets, or a comparison of program counter activity for the core thread and redundant branch processor thread.

## Claims

### Claim 1

A fault-detecting pipeline processor comprising a core processor and a redundant branch processor;
the core processor configured to execute control instructions, branch control instructions which are a subset of the control instructions, the branch control instructions including at least one of: variable initialization instructions, branch instructions, variable arithmetic instructions associated with branch instructions, and no operation (NOP) instructions;
the core processor also configured to execute control instructions and data instructions, the core processor comprising, in sequence, a fetch stage coupled to a decode stage coupled to a decode-execute stage coupled to an execute stage coupled to a load-store stage coupled to a writeback stage;
the redundant branch processor configured to execute only branch control instructions, the redundant branch processor comprising, in sequence, a fetch stage coupled to a decode stage coupled to a decode-execute stage coupled to an execute stage coupled to a load-store stage coupled to a writeback stage;
a fault detector receiving branch status values from the core processor and branch status values from the redundant branch processor, the branch status values comprising at least one of: a branch target, a branch direction, and a branch taken/not taken;
the fault detector asserting an output when at least one of a branch status comprising: a branch target, branch direction, or a branch taken/not taken of the core processor does not match a branch status comprising at least one of: a branch target, branch direction, or branch taken/not taken of the redundant branch processor;
where the core processor and redundant branch processor are configured to operate concurrently during a first time interval and are configured to operate separately during a second time interval.

### Claim 2 (depends on 1)

The fault-detecting pipeline processor of claim 1 where the branch instructions include at least a conditional branch instruction or unconditional branch instruction.

### Claim 3 (depends on 1)

The fault-detecting pipeline processor of claim 1 where the execution control instructions and execution data instructions include instructions from a Reduced Instruction Set Computer (RISC) instruction set.

### Claim 4 (depends on 1)

The fault-detecting pipeline processor of claim 1 where the data instructions include arithmetic operation instructions.

### Claim 5 (depends on 4)

The fault-detecting pipeline processor of claim 4 where the arithmetic operation instructions include an add instruction and a multiply instruction.

### Claim 6 (depends on 1)

The fault-detecting pipeline processor of claim 1 where the core program performs a Sum a*x(i)+y(i) operation.

### Claim 7 (depends on 1)

The fault-detecting pipeline processor of claim 1 where the fault detector comprises a core processor branch table and a redundant branch processor branch table, each core processor branch table and redundant branch processor branch table being a circular queue of storage locations containing a sequence of branch status values.

### Claim 8 (depends on 1)

The fault detecting pipeline processor of claim 1 where the fault detector comprises a table containing a list of branch status values comprising at least one of: branch taken/not taken, branch direction, and/or a list of branch target locations.

### Claim 9 (depends on 8)

The fault detecting pipeline processor of claim 8 where the list of branch status values is computed by the redundant branch processor prior to execution of a program by the core processor.

### Claim 10

A process for generating an executable redundant branch processor thread from a core processor thread, the core processor thread having at least data instructions and control instructions, the control instructions including a subset of branch control instructions including at least one of: branch control variable initialization instructions, branch control variable modification instructions, and branch instructions, the process comprising:
identifying an execution branch control in the core processor thread;
identifying a branch control initialization value for the execution branch control in the core processor thread;
identifying an execution branch control in the core processor thread and inserting a branch control initialization in a corresponding location in the executable redundant branch processor thread;
identifying a branch control conditional branch in the core processor thread and inserting a corresponding conditional branch instruction in a corresponding location of the executable redundant branch processor thread;
identifying executable instructions in the core processor thread execution branch control which are not branch control instructions and inserting no operation (NOP) instructions in the corresponding locations of the executable redundant branch processor thread;
where the core processor thread performs a Sum a*x(i)+y(i) operation.

### Claim 11 (depends on 10)

The process of claim 10 where the redundant branch process thread has a branch target which is a fixed offset from a corresponding branch target of the core processor thread.

### Claim 12 (depends on 10)

The process of claim 10 where the control instructions and data instructions are Reduced Instruction Set Computer (RISC) instructions.

### Claim 13

A process for generating an executable redundant branch processor thread from a core processor thread, the core processor thread having at least branch control instructions and data instructions, the process comprising:
identifying an execution loop in the core processor thread;
identifying an initialization value for the execution loop in the core processor thread;
identifying an execution loop variable initialization in the core processor thread and inserting an execution loop variable initialization in a corresponding location in the executable redundant branch processor thread;
identifying an execution loop variable modification in the core processor thread and inserting an execution loop variable modification in a corresponding location in the executable redundant branch processor thread;
creating a fault detection table containing a list of branch status values comprising at least one of: branch taken/not taken, branch direction, and/or a list of branch target locations, and the list of branch status values is computed by the redundant branch processor prior to execution of a program by the core processor.

### Claim 14

A fault-detecting pipeline processor comprising:
a core processor configured to execute control instructions and data instructions, the control instructions including a subset of branch control instructions comprising at least one of: a no operation (NOP) instruction, branch control variable initialization instructions, branch control variable modification instructions, conditional branch instructions, unconditional branch instructions;
the core processor generating branch status comprising at least one of a branch taken/not taken, branch direction, and branch target;
a redundant branch processor configured to execute only branch control instructions, the redundant branch processor generating branch status comprising at least one of a branch taken/not taken, branch direction, and branch target;
a fault detector comparing branch status from the core processor and branch status from the redundant branch processor;
the fault detector asserting a fault output when the corresponding branch status from the core processor and redundant branch processor are not the same value;
where the redundant branch processor generates a list of branch status prior to execution of the core processor generating a list of branch status.

### Claim 15 (depends on 14)

The fault-detecting pipeline processor of claim 14 where the fault detector stores the branch status from the core processor and redundant branch processor in a list.

### Claim 16 (depends on 14)

The fault-detecting pipeline processor of claim 14 where the core processor is configured to execute Reduced Instruction Set (RISC) instructions.

### Claim 17 (depends on 14)

The fault-detecting pipeline processor of claim 14 where the redundant branch processor branch control instructions are an unconditional branch.

### Claim 18 (depends on 14)

The fault-detecting pipeline processor of claim 14 where the redundant branch processor branch control instructions are an iteration variable initialization, an iteration variable modification, and a conditional branch.