Augmented Memory Instructions for Buffer Overflow Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current CPU architectures are vulnerable to buffer overflow attacks, as they do not effectively prevent the execution of injected bytecode due to the lack of execute disable flags, which recognize bytecode as general-purpose data and allow its execution by the CPU.
Innovation Solution
Introducing augmented load and store instructions that include permission validation to ensure that the permissions specified by the instructions match the permissions associated with the memory addresses, preventing execution by triggering a page fault if permissions do not match, thereby enhancing security against malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If CPU architectures use general-purpose data recognition for bytecode, then bytecode can be executed by the CPU, but the system becomes vulnerable to buffer overflow attacks and malicious code execution
Solution Approach 1:
The patent changes the permission parameters associated with bytecode memory regions by introducing execute disable flags that set specific permission bits (readable, writable, executable) to prevent malicious code execution while maintaining legitimate bytecode functionality
Solution Approach 2:
The patent introduces an intermediary permission validation mechanism that acts between the CPU and bytecode execution, using augmented instructions to check execute disable flags and prevent unauthorized code execution without affecting normal bytecode operation
2Reliability
If execute disable flags are introduced to prevent malicious code execution, then security against buffer overflow attacks is improved, but the complexity of the CPU architecture increases
Solution Approach 1:
The patent implements execute disable flags using existing permission bit fields in the CPU architecture that are already used for memory management, allowing the same mechanism to serve both traditional memory protection and new security functions without adding separate dedicated hardware structures
Solution Approach 2:
The patent modifies existing permission parameters (readable, writable, executable bits) to incorporate security checks, reusing existing architectural parameters for dual purposes of memory management and security enforcement
3Reliability
If augmented load and store instructions with permission validation are implemented, then security is enhanced by preventing unauthorized memory operations, but the instruction complexity and processing overhead increase
Solution Approach 1:
The patent merges permission validation logic directly into the existing load and store instruction execution paths, combining security checks with standard memory access operations to avoid separate validation steps and reduce overall system complexity
Data Source
AI summary
Systems and methods for executing an augmented program instruction are described. An example method may include a central processing unit receiving an executable program instruction. The central processing unit determines that the executable program instruction is an augmented program instruction. The augmented program instruction may include operands that provide input for an operation to be performed and an additional operand specifying a validation permission value to be compared to a permission value associated with a page table entry referenced by the augmented program instruction. Upon determining that the validation permission value specified in the augmented program instruction matches the permission value associated with the page table entry referenced by the augmented program instruction, the central processing unit performing the operation specified by the augmented program instruction.