US 2017/0364684 A1 · IN-MEMORY ATTACK PREVENTION

Abstract

Examples relate to in-memory attack prevention. The examples disclosed herein enable obtaining, in response to a first boot command, a first encryption key generated based on a randomization process. The examples further enable determining whether first information of a page table indicates that a memory page is intended to be secure, the page table storing mapping between a virtual address of the memory page and a physical address of the memory page. In response to determining that the first information indicates that the memory page is intended to be secure, the examples further enable determining whether second information of the page table indicates that the memory page is encrypted. In response to determining that the second information indicates that the memory page is not encrypted, the examples further enable encrypting the memory page in a physical memory using the first encryption key.

Claims15

Dependent claims

A method for execution by a computing device for in-memory attack prevention, the method comprising:

obtaining, in response to a first boot command, a first encryption key generated based on a randomization process;
determining whether first information of a page table indicates that a memory page is intended to be secure, the page table storing mapping between a virtual address of the memory page and a physical address of the memory page;
in response to determining that the first information indicates that the memory page is intended to be secure, determining whether second information of the page table indicates that the memory page is encrypted;
and
in response to determining that the second information indicates that the memory page is not encrypted, encrypting the memory page in a physical memory using the first encryption key.

2 more elements

A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for in-memory attack prevention, the machine-readable storage medium comprising:

receiving, during a first boot session, an indication that a set of codes is loaded into at least a portion of a physical memory page;
identifying, in a page table, a page entry corresponding to the physical memory page, wherein the page entry maps a virtual memory page to the physical memory page;
and
determining whether an encryption field associated with the page entry indicates that the physical memory page is encrypted, wherein, in response to determining that the encryption field indicates that the physical memory page is not encrypted, the processor is prevented from accessing the set of codes until the physical memory page is encrypted using a first encryption key that is unique to the first boot session.

1 more element

Dependencies are inferred from the claim text.

In-memory attack prevention

Life of this patent

In-memory attack prevention

Life of this patent

Abstract

Claims15