Secure processor for detecting and preventing exploits of software vulnerability
AssigneeThe Research Foundation for The State University of New York
InventorKanad Ghose
Life of this patent
Estimating the term…
Abstract
A secure processor, comprising a logic execution unit configured to process data based on instructions; a communication interface unit, configured to transfer of the instructions and the data, and metadata tags accompanying respective instructions and data; a metadata processing unit, configured to enforce specific restrictions with respect to at least execution of instructions, access to resources, and manipulation of data, selectively dependent on the received metadata tags; and a control transfer processing unit, configured to validate a branch instruction execution and an entry point instruction of each control transfer, selectively dependent on the respective metadata tags.
Claims29
A secure processor, comprising:
- an interface configured to receive an executable program comprising instructions and associated instruction tags;
- instruction execution hardware;
- and
- tag processing hardware, configured to:
- process information in the associated instruction tags to enforce at least one specific context-dependent behavior for a respective instruction during execution of the respective instruction;
- and
- prevent unauthorized modifications of the instruction tags before, during and after execution.
A secure processing method, comprising:
- providing an automated processor having tag processing hardware;
- receiving an executable program comprising instructions and associated instruction tags;
- processing information in associated instruction tags to enforce at least one specific context-dependent behavior for a respective instruction during execution of the respective instruction;
- and
- preventing unauthorized modifications of the instruction tags before, during and after execution.
A processing method, comprising:
- receiving an executable program comprising instructions and an instruction tag associated with the instruction by processing hardware, the instruction tags comprising information for enforcement of specific context-dependent behaviors for the corresponding instruction, the instruction tags being stored securely, unmodifiable by program execution, and unmodifiable by the processing hardware;
- and
- processing instructions and corresponding instruction tags for respective instructions, to execute the program while enforcing the specific context-dependent behaviors.
The method of claim 21, further comprising determining whether to execute the instruction, read from a memory location, or write to the memory location, based on at least information contained in the instruction tag associated with the instruction and information contained in data tags associated with the memory location targeted for use by the instruction.
Dependencies are inferred from the claim text.