Branch Instruction Authentication for Secure Program Flow
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing pointers and branch instructions in processing systems are inadequate, leaving them vulnerable to malicious attacks that can modify program flow.
Innovation Solution
Implementing apparatuses and methods that encrypt and authenticate pointers and branch instructions using cryptographic techniques, such as cryptographic shuffling and authentication values, to ensure their integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic signing and authentication methods are applied to pointers and branch instructions, then security against malicious attacks is improved, but device complexity increases
Solution Approach 1:
The authentication mechanism is divided into separate components: instruction authentication circuitry that generates authentication values, branch instruction structures that carry these values, and verification circuitry that validates them. This segmentation allows each component to be optimized independently while maintaining overall security functionality.
Solution Approach 2:
An authentication value acts as an intermediary element between the branch instruction and the verification process. This intermediary carries cryptographic information that mediates the trust relationship, allowing secure verification without requiring direct complex cryptographic operations at every step.
2Reliability
If authentication values are combined with branch instructions, then integrity of program flow is improved, but instruction processing time increases
Solution Approach 1:
The authentication value is generated and combined with the branch instruction in advance, before the branch is executed. This preliminary action ensures that when the branch is later verified and executed, the authentication is already in place, reducing the time required during the critical execution path.
Solution Approach 2:
The branch instruction structure is designed to self-containedly carry its own authentication value, allowing it to be verified independently without requiring external authentication mechanisms. This self-service approach minimizes the time needed for verification by eliminating dependency on external authentication systems.
Data Source
AI summary
Aspects of the present disclosure relate to an apparatus. Instruction receiving circuitry receives, as part of a program flow, a branch instruction, said branch instruction identifying a function. Instruction authentication circuitry determines, based at least in part on the function, an instruction authentication value. The instruction authentication circuitry then combines the instruction authentication value with the branch instruction to produce an authenticatable branch instruction. Branch circuitry authenticates the authenticatable branch instruction based on a function authentication value. Responsive to a successful authentication of the authenticatable branch instruction, the branch circuitry executes a jump in the program flow to said function.