Secure processor for detecting and preventing exploits of software vulnerability
AssigneeThe Research Foundation for The State University of New York
InventorKanad Ghose
Life of this patent
Estimating the term…
Abstract
A secure processor, comprising a logic execution unit configured to process data based on instructions; a communication interface unit, configured to transfer of the instructions and the data, and metadata tags accompanying respective instructions and data; a metadata processing unit, configured to enforce specific restrictions with respect to at least execution of instructions, access to resources, and manipulation of data, selectively dependent on the received metadata tags; and a control transfer processing unit, configured to validate a branch instruction execution and an entry point instruction of each control transfer, selectively dependent on the respective metadata tags.
Claims20
A secure processor, comprising:
- a cache comprising a cache line comprising memory locations configured to store a plurality of instructions and a plurality of instruction tags, each instruction having an associated tag;
- tag processing unit, configured to receive the instruction tag from the cache line, and to determine a restriction defined by the instruction tag before completion of execution of the instruction associated with the tag;
- and
- a logic execution unit configured to receive the instruction from the cache line, and subject to the determined restriction, at least one of execute the instruction, restrict access to at least one resource, and restrict a manipulation of data.
A secure microprocessor, comprising:
- a cache comprising a cache line, each cache line comprising memory locations configured to store an instruction, and a memory location for storing a tag accompanying each instruction, wherein the cache line is configured to store a plurality of instructions and a plurality of accompanying tags;
- a tag processing unit, configured to receive the accompanying tag from the cache line, concurrently enforce a specific restriction with respect to at least execution of the instruction, access to at least one resource, and manipulation of data, selectively dependent on the accompanying tag from the cache line;
- and
- a logic execution unit comprising an instruction processing pipeline, configured to receive the instruction from the cache line, decode the instruction, and process the data based on the instruction in the instruction processing pipeline, subject to enforcement of the specific restrictions by the tag processing unit.
A secure microprocessor, comprising:
- a cache having a cache line, configured to store a plurality of instructions and a plurality of instruction tags, each instruction having an associated instruction tag, and a plurality of data and a plurality of data tags, and each datum having an associated data tag;
- the associated instruction tag for a respective instruction comprising information to enforce context-dependent behavior, and each data tag containing information indicating limitations on behavior of the logic unit with respect to the respective datum;
- a tag processing unit, configured to receive the associated instruction tag and the associated data tag from the cache line, and to define a signal to control the context-dependent behavior concurrent with execution of execution of the instruction;
- and
- a logic unit configured to receive and execute instructions from the cache line dependent on data, and the signal.
Dependencies are inferred from the claim text.