US 2017/0285986 A1 · SECURE MEMORY CONTROLLER

Abstract

Methods and apparatus for a secure memory controller. The secure memory controller includes circuitry and logic that is programmed to prevent malicious code from overwrite protected regions of system memory. The memory controller observes memory access patterns and trains itself to identify thread stacks and addresses relating to the thread stacks including stack-frame pointers and return addresses. In one aspect, the memory controller prevents a return address from being overwritten until a proper return from a function call is detected. The memory controller is also configured to prevent malicious code from overwriting page table entries (PTEs) in page tables. Pages containing PTEs are identified, and access is prevented to the PTEs from user-mode code. The PTEs are also scanned to detect corrupted PTEs resulting from bit manipulation by malicious code.

Claims25

Dependent claims

A method performed by a memory controller, comprising:

controlling access to system memory, the accesses including memory writes and memory reads;
monitoring patterns of accesses to the system memory;
detecting a return address for a function call in the system memory;
and
preventing the return address from being overwritten unless the memory controller determines it is safe.

2 more elements

An apparatus, configured to interface with system memory when installed in a computer system including system memory, comprising:

a memory controller including circuitry and logic configure to,
receive memory access requests comprising write and read accesses for writing to and reading from the system memory, each write and read access including an address in an address space for the system memory;
monitor patterns of accesses to the system memory;
identify, via observation of access patterns to the system memory, regions of memory to protect write access from malicious code;
detect, based on observed memory access patterns, a memory write access request to a region of memory to be protected from malicious code;
and
detect whether the memory write access request is unsafe, and if it is, deny the write access request,
otherwise, allow the write access request to proceed.

5 more elements

A system comprising:

system memory having an address space;
a processor including,
a plurality of processor cores, each including a local level 1 (L1) and level 2 (L2) cache and coupled to an interconnect;
a last level cache, coupled to the interconnect;
system memory;
a memory controller, operative coupled to the last level cache and including an interface coupled to system memory, including circuitry and logic configure to,
receive memory access requests comprising write and read accesses for writing to and reading from the system memory, each write and read access including an address in the system memory;
monitor patterns of accesses to the system memory;
identify, via observation of access patterns to the system memory, regions of memory to protect write access from malicious code;
detect, based on observed memory access patterns, a memory write access request to a region of memory to be protected from malicious code;
and
detect whether the memory write access request is unsafe, and if it is, deny the write access request,
otherwise, allow the write access request to proceed.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application

15/086,523Filed 31 Mar 2016

Published

5 Oct 2017

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

G06F 12/0897
Caches characterised by their organisation or structure: with two or more cache hierarchy levels
G06F 12/1425
By checking the object accessibility, e.g. type of access defined by the memory independently of subject rights: the protection being physical,…
G06F 21/78
Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer: to…
G06F 2212/1052
Providing a specific technical effect: security improvement

Secure memory controller

Life of this patent

Secure memory controller

Life of this patent

Abstract

Claims25