Hardware-enforced code paths
AssigneeMcAfee, Inc.
InventorsCarl D. Woodward, Jennifer Eligius Mankin, Jeremy Bennett
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example, a computing apparatus, including: first one or more logic elements providing a code module, the code module comprising a member having a branching policy designating either a public or private member; second one or more logic elements providing a policy engine, operable to: receive a first branch instruction to the member; determine that the branch instructions does not meet the policy; and take a security action. There is also disclosed a method of providing a policy engine, and a computer-readable medium having stored thereon executable instructions for providing a policy engine.
Claims18
A computing apparatus, comprising:
- first one or more logic elements, including at least a hardware logic element, comprising a module providing executable code including a cryptographically signed private routine having a public entry point, the public entry point configured to be accessible by an unprivileged process, the private routine having associated therewith a branching policy comprising a requirement that entry to the private routine be from a signed entry point;
- and
- second one or more logic elements, including at least a hardware logic element, comprising a policy engine, operable to:
- receive a first branching instruction to the private routine;
- determine that the first branching instruction is not a signed entry point for the private routine, comprising a branch check selected from predictive branch checking, comprising evaluating the branching policy before branching, and reactive branch checking, comprising evaluating the branching policy after branching;
- and
- take a security action.
One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a policy engine, operable to:
- execute a module providing executable code, including a cryptographically signed private routine having a public entry point, the public entry point configured to be accessible by an unprivileged process, the private routine having associated therewith a branching policy comprising a requirement that entry to the private routine be from a signed entry point;
- receive a first branching instruction to the private routine;
- determine that the first branching instruction is not a signed entry point for the private routine, comprising a branch check selected from predictive branch checking, comprising evaluating the branching policy before branching, and reactive branch checking, comprising evaluating the branching policy after branching;
- and
- take a security action.
A computer-implemented method of providing a policy engine for branching instructions, comprising:
- executing a module providing executable code, including a cryptographically signed private routine having a public entry point, the public entry point configured to be accessible by an unprivileged process, the private routine having associated therewith a branching policy comprising a requirement that entry to the private routine be from a signed entry point;
- receiving a first branching instruction to the private routine;
- determining that the first branching instruction is not a signed entry point for the private routine, comprising a branch check selected from predictive branch checking, comprising evaluating the branching policy before branching, and reactive branch checking, comprising evaluating the branching policy after branching;
- and
- taking a security action.
Dependencies are inferred from the claim text.