Software execution randomization

An instruction fetch unit comprising:

• a first memory portion whose contents identify an address of a protected instruction, wherein the protected instruction, when executed by one or more processors, causes the one or more processors to perform a certain function;
• a second memory portion whose contents store addresses of a plurality of alternate instructions corresponding to the protected instruction, wherein each of the alternate instructions, when executed by the one or more processors, causes the one or more processors to perform the certain function that would have been performed by the one or more processors when executing the protected instruction;
• a replacement unit that a) determines whether an instruction to be fetched corresponds to the contents of the first memory portion, and if so, b) replaces an address associated with the instruction to be fetched with an address selected from the second memory portion, wherein replacing the address associated with the instruction to be fetched comprises randomly or pseudo-randomly selecting an address of an instruction from corresponding addresses in the second memory portion, and replacing the contents of the first memory portion with the selected address;
• and
• an interface that fetches an instruction.

An instruction fetch unit comprising:

• a first memory portion whose contents identify an address of an instruction to be fetched;
• a second memory portion whose contents identify an address of a protected instruction, wherein the protected instruction, when executed by one or more processors, causes the one or more processors to perform a certain function;
• a third memory portion whose contents store addresses of a plurality of alternate instructions corresponding to the protected instruction, wherein each of the alternate instructions, when executed by the one or more processors, causes the one or more processors to perform the certain function that would have been performed by the one or more processors when executing the protected function;
• a replacement unit that a) determines whether the contents of the first memory correspond to the contents of the second memory, and if so, b) replaces the contents of the first memory with an address selected from the third memory, wherein replacing the contents of the first memory portion with the address selected from the third memory portion comprises randomly or pseudo-randomly selecting a corresponding address of an alternate instruction from the third memory portion, and replacing the contents of the first memory portion with the selected address;
• and
• an interface that fetches an instruction corresponding to the contents of the first memory.

A method, performed by an instruction fetch unit, of processing instructions in an instruction stream, the method comprising:

• identifying an instruction in an instruction stream that calls a function;
• determining if the function to be called is a protected function, wherein the protected function causes one or more processors to perform one or more actions and reach a result;
• and
• if the function to be called is a protected function, selecting an alternate function from a plurality of alternate functions corresponding to the protected function, wherein selecting the alternate instruction comprises randomly or pseudo-randomly selecting an alternate instruction from the plurality of alternate instructions, and wherein each alternate function causes one or more processors to perform one or more different actions and reach the result of the protected function, and replacing the identified instruction with an instruction that calls the selected alternate function.

An instruction fetch unit comprising:

• a program address pointer that stores an address of an instruction to be fetched;
• a protected instruction address register (PIAR) that stores an address of a protected instruction, wherein the protected instruction, when executed by one or more processors, causes the one or more processors to perform a certain function;
• a memory portion that stores addresses of a plurality of alternate instructions corresponding to the protected instruction, wherein each of the alternate instructions, when executed by the one or more processors, causes the one or more processors to perform the certain function that would have been performed by the one or more processors when executing the protected instruction;
• a replacement unit that a) determines whether the address stored in the program address pointer corresponds to the address stored in the PIAR, and if so, b) replaces the address stored in the program address pointer with an address selected from the addresses stored in the memory portion, wherein replacing the address stored in the program address pointer comprises randomly or pseudo-randomly selecting a corresponding address of an alternate instruction from the memory portion, and replacing the address stored in the program address pointer with the selected address;
• and
• an interface that fetches an instruction corresponding to either the address stored in the program address pointer or the replaced address stored in the program address pointer.

A device comprising:

• a processor that executes programming instructions;
• a memory portion that stores programming instructions;
• an instruction fetch unit that fetches a programming instruction from the memory portion and provides the fetched programming instruction to the processor for execution;
• and
• a replacement unit that replaces the fetched programming instruction with an alternate programming instruction selected from a plurality of alternate programming instructions corresponding to the fetched programming instruction, wherein selecting the alternate instruction comprises randomly or pseudo-randomly selecting the alternate instruction from the plurality of alternate instructions, and provides the alternate programming instruction to the processor for execution when the fetched programming instruction is a protected programming instruction, wherein the protected programming instruction, when executed by the processor, causes the processor to perform a certain function, and wherein each of the alternate programming instructions, when executed by the processor, causes the processor to perform the certain function that would have been performed by the processor when executing the protected programming instruction.

A device comprising:

• a processor means that executes programming instructions;
• a memory means that stores programming instructions;
• an instruction fetch means that fetches a programming instruction from the memory means and provides the fetched programming instruction to the processor means for execution;
• and
• a replacement means that replaces the fetched programming instruction with an alternate programming instruction selected from a plurality of alternate programming instructions corresponding to the fetched programming instruction, wherein selecting the alternate instruction comprises randomly or pseudo-randomly selecting the alternate instruction from the plurality of alternate instructions, and provides the alternate programming instruction to the processor means for execution when the fetched programming instruction is a protected programming instruction, wherein the protected programming instruction, when executed by the processor means, causes the processor means to perform a certain function, and wherein each of the alternate programming instructions, when executed by the processor means, causes the processor means to perform the certain function that would have been performed by the processor when executing the protected programming instruction.