Apparatus, system and method for protecting function return address
OwnerCarla E. Brodley, Terani N. Vijaykumar +2inventors
InventorsCarla E. Brodley, Terani N. Vijaykumar, Hilmi Ozdoganoglu, Benjamin A. Kuperman
Life of this patent
Estimating the term…
Abstract
An apparatus, system, and method for protecting a computing device from attacks while the computing device is in operation is provided. In one embodiment, the apparatus includes an input/output unit, a control unit, an execute unit, and first and second memory areas. The first memory area is accessible by a user of the computing device. The second memory area is not accessible by any users. The second memory area is configured to store return addresses and stack pointers.
Claims20
An apparatus for protecting a computing device from attacks during operation of the computing device, the apparatus comprising:
- an input/output unit,
- a control unit coupled to the input/output unit,
- an execute unit coupled to the control unit,
- a first memory area including memory that is accessible by a user of the computing device, and
- a second memory area including memory that is not accessible by the user, the second memory area being configured to store a plurality of return addresses and stack pointers.
A computing device, comprising:
- means for receiving data and programming instructions,
- means for processing the data according to the instructions,
- means for storing return addresses generated by the means for processing in a first memory area,
- means for storing the return addresses in a second memory area not accessible by computer users, and
- means for evaluating a return address from the first memory area and a return address from the second memory area to determine whether an attack on a return address has occurred.
A computer-readable medium comprising instructions that operate to prevent attacks on return addresses during execution of a computer program, the instructions being executable to:
- store a first return address in a first memory area,
- store the first return address in a second memory area that is not accessible by computer users,
- retrieve a second return address from the first memory area,
- compare the first return address and the second return address, and
- generate an exception if the first return address is different from the second return address.
A computer-readable medium, for use in connection with a computing device, the computer-readable medium including a plurality of instructions that when executed protect the computing device from attacks on return addresses, at least a portion of the computer-readable medium comprising a first memory which is:
- configured to store a plurality of return addresses during execution of a computer program,
- protected from access by users of the computing device during execution of the computer program, and
- accessed by instructions that compare the plurality of return addresses with return addresses stored in a second memory in the computing device.
A method of preventing attacks on return addresses during execution of a computer program on a computing device, the method comprising the steps of:
- storing a first return address in a first memory that is accessible to computer users and in a second memory that is not accessible to computer users,
- retrieving a second return address from the first memory,
- comparing the first return address and the second return address, and
- generating an exception if the results of the comparing step indicate that an attack has been attempted.
Dependencies are inferred from the claim text.