Authentication Code Generation Instruction for CPU Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems face challenges in protecting against return-oriented-programming (ROP) attacks, where attackers manipulate function return addresses to execute unauthorized code, and existing solutions often require additional architectural registers or complex code generation, leading to performance issues and increased complexity.
Innovation Solution
A single instruction is used to generate and store an authentication code based on a source value, such as a function return address, directly in memory, avoiding the need for additional architectural registers and simplifying code generation by overlapping instruction execution, even in simple in-order CPU designs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication code generation uses multiple instructions and additional architectural registers, then security against ROP attacks is improved, but device complexity and code size increase
Solution Approach 1:
The patent combines authentication code generation and memory storage into a single instruction execution. The authentication code is generated and stored to memory in one atomic operation, eliminating the need for multiple instructions and additional architectural registers. This merging approach maintains security while reducing code complexity and size.
Solution Approach 2:
The single instruction performs multiple functions: it generates the authentication code based on the source value and simultaneously stores it to the specified memory location. This multi-functionality eliminates the need for separate generation and storage operations, reducing overall system complexity while maintaining security.
2Reliability
If authentication code generation uses multiple instructions, then security is improved, but execution time increases
Solution Approach 1:
By merging authentication code generation and memory storage into a single instruction, the patent eliminates the sequential execution overhead of multiple instructions. The authentication code is generated and stored in one atomic operation, reducing total execution time while maintaining security guarantees.
Solution Approach 2:
The authentication code is generated as part of the store operation itself, rather than requiring preliminary generation steps. The single instruction performs the generation and storage atomically, eliminating delays associated with multi-instruction sequences and allowing subsequent instructions to commence execution sooner.
3Reliability
If authentication code is stored in architectural registers, then security is improved, but quantity of registers required increases
Solution Approach 1:
The patent extracts the authentication code storage from architectural registers and places it directly in memory. By storing the authentication code to memory locations associated with store addresses formed using register values, the system eliminates the need for additional architectural registers while maintaining secure storage.
Solution Approach 2:
The authentication code storage is merged with the data storage operation. Both the data value and authentication code are stored to memory in the same atomic operation, eliminating the need for separate register storage and reducing the total number of architectural registers required.
Data Source
AI summary
An apparatus comprises processing circuitry to execute instructions, and decode circuitry to decode the instructions for execution by the processing circuitry. The decode circuitry is responsive to an authentication code generation instruction specifying a first source value to control the processing circuitry to generate an authentication code dependent on the first source value, and store the authentication code to a memory location associated with a store address formed using a value obtained from a register. By providing a single instruction, this reduces register pressure enabling improved performance by avoiding unnecessary load/store operations, and makes compilation of code using the authentication code generation instruction simpler. Because it does not store the result of the cryptographic function in the register bank, it also enables simple in-order CPU designs to hide the latency of slow cryptographic computations by allowing subsequent instructions to start executing before the cryptographic computation has completed.