US 12,216,921 B1Granted

Secure monitors for memory page protection

AssigneeAmazon Technologies, Inc.

InventorsErez Tsidon, Ori Cohen, Barak Wasserstrom, Andrew Robert Sinton, Asaf Modelevsky, Moshe Raz

Life of this patent

Estimating the term…

Loading patent…

Abstract

Technologies are disclosed for using hardware-embedded monitors to monitor pages of local memory and detect attribute violations or other unauthorized operations relating to the memory. The attribute violations may include mismatches of attributes (e.g., designating a page as writeable versus executable or vice versa) in entries in a translation buffer that point to a same physical address or other mismatches between designations of attributes for a page in physical and virtual space. Responsive to detecting a violation, an alert or other mitigation protocol, which may include an audit of activities surrounding the violation, may be performed.

Claims19

Dependent claims

A computer system comprising:

first memory for storing executable instructions, the executable instructions including first instructions for an application stored in a page of the first memory having an associated attribute;
and
a system-on-chip (SoC) including a first processing component and a hardware monitor comprising a second processing component, the first processing component configured to communicate with the first memory and execute the executable instructions on the first memory, the second processing component configured to execute second instructions to:
monitor memory operations for the first processing component relating to the page of the first memory, including loading contents of one or more translation buffers for the first processing component into a mappings memory and operating a plurality of computing processing units in parallel to execute the second instructions to compare attribute designations for page references in the one or more translation buffers, and
responsive to detecting, based on the monitoring of the memory operations, a conflict between respective designations of the attribute of the page of the first memory in respective entries in the one or more translation buffers of the first processing component, performing an operation to mitigate the conflict, the operation including issuing an alert to an external secure system indicating information relating to the conflict.

2 more elements

A method comprising:

detecting, with a monitor comprising a first processing component embedded in computing hardware executing instructions to monitor memory operations in the computing hardware, a conflict between respective designations of an attribute of a selected page of a memory of the computing hardware in one or more translation buffers used by a second processing component of the computing hardware, wherein the conflict comprises two entries in the one or more translation buffers that point to a same physical address of the memory corresponding to the selected page, where a first entry of the two entries designates an executable attribute for the selected page and a second entry of the two entries designates a writeable attribute for the selected page;
and
performing a first mitigation mechanism to mitigate the conflict in response to detecting the conflict, wherein the first mitigation includes intercepting a violating command or instruction to prevent a requested change to an attribute of the selected page or quarantining the computing hardware.

An integrated circuit comprising:

a first processing component, the first processing component configured to communicate with a first memory for storing first executable instructions;
and
a hardware monitor embedded in the integrated circuit, the hardware monitor comprising a mappings memory and a second processing component comprising one or more computing processing units configured to execute second instructions to:
load contents of one or more translation buffers into the mappings memory;
detect a conflict relating to an attribute of an executable page of the first memory based on an analysis of attributes of the executable page in entries of the one or more translation buffers referencing the executable page, wherein the conflict comprises a mismatch in attributes for virtual addresses in the one or more translation buffers that point to a same physical address in the first memory;
and
perform a mitigation mechanism to mitigate the conflict in response to the conflict, the mitigation mechanism including sending an alarm to an external secure service indicating the conflict for the executable page, and the mitigation mechanism further including one or more of intercepting an instruction or command to cause the conflict and preventing the instruction or command from reaching the first memory, or quarantining the computing hardware by freezing the first memory, disallowing one or more executable pages in the first memory from running, or preventing the integrated circuit from accessing a network.

4 more elements

Dependencies are inferred from the claim text.