Cryptographic pointer address encoding
AssigneeIntel Corporation
InventorsDavid M. Durham, Baiju Patel
Life of this patent
Estimating the term…
Abstract
A computing device includes technologies for securing indirect addresses (e.g., pointers) that are used by a processor to perform memory access (e.g., read/write/execute) operations. The computing device encodes the indirect address using metadata and a cryptographic algorithm. The metadata may be stored in an unused portion of the indirect address.
Claims25
A computing device to cryptographically encode indirect addresses, the computing device comprising:
- a processor comprising address encoding logic to encode an indirect address during execution of a computer program and on a memory allocation operation that allocates memory and returns the indirect address, wherein the indirect address comprises a plurality of unused bits and a plurality of used bits, and wherein the used bits are to store data indicative of a memory location of the allocated memory,
- wherein to encode the indirect address comprises to:
- determine metadata associated with the indirect address, the metadata indicative of a memory access permitted by the indirect address;
- store the metadata in the unused bits of the indirect address;
- determine a portion of the indirect address to encrypt based on the metadata;
- encrypt the determined portion of the indirect address;
- and
- output of the encoded indirect address for use by a memory access instruction.
A method for securing indirect addresses to mitigate buffer overflow attacks, the method comprising:
- causing a processor to encode an indirect address during execution of a computer program and on a memory allocation operation that allocates memory for a buffer and returns an indirect address, wherein the indirect address comprising a plurality of unused bits and a plurality of used bits, and wherein the used bits to store data indicating a memory location of the buffer,
- wherein causing the processor to encode the indirect address comprises:
- determining an upper limit on the size of the buffer;
- storing data indicative of the upper limit on the buffer size in the unused bits of the indirect address;
- determining a portion of the indirect address to encrypt based on the data indicative of the upper limit on the buffer size;
- encrypting the determined portion of the indirect address;
- and
- outputting the encoded indirect address for use by a memory access instruction of the processor.
One or more non-transitory machine readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause a computing device to:
- encode an indirect address during execution of a computer program and on a memory allocation operation that allocates memory for a buffer and returns an indirect address, wherein the indirect address comprising a plurality of unused bits and a plurality of used bits, and wherein the used bits to store data indicating a memory location of the buffer,
- wherein to encode the indirect address comprises to:
- determine an upper limit on the size of the buffer;
- store data indicative of the upper limit on the buffer size in the unused bits of the indirect address;
- determine a portion of the indirect address to encrypt based on the data indicative of the upper limit on the buffer size;
- encrypt the determined portion of the indirect address;
- and
- output the encoded indirect address for use by a memory access instruction of the processor.
Dependencies are inferred from the claim text.