Control Flow Signature Validation Hardware Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems are vulnerable to cyber attacks due to the lack of systematic enforcement of memory safety, type safety, distinction between code and data, and constraints on information flow and access, leading to compromised security and difficulty in recovering from attacks.
Innovation Solution
A hardware mechanism for continuous validation of program execution, which includes generating and verifying control flow signatures to ensure that only expected instructions are executed, providing immunity against runtime compromises and maintaining negligible execution overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware mechanisms are added for continuous validation of program execution, then security and reliability are improved, but device complexity increases
Solution Approach 1:
The patent pre-computes control flow signatures for all valid execution paths during program compilation or deployment, storing them in a lookup table before runtime. This preliminary action eliminates the need for complex real-time computation of control flow validation, as the hardware only needs to compare current execution state against pre-stored signatures, thereby improving reliability while minimizing added complexity
Solution Approach 2:
The patent replaces complex software-based security validation mechanisms with streamlined hardware implementation. The control flow validation is performed using dedicated hardware circuits that compute signatures and perform comparisons in parallel with normal execution, substituting mechanical/software complexity with optimized hardware logic that achieves the same security goal with reduced operational overhead
2Measurement precision
If control flow validation is performed at every branch instruction, then measurement precision of execution integrity is improved, but processing speed deteriorates
Solution Approach 1:
The patent implements continuous control flow validation by integrating signature computation and comparison operations that proceed in parallel with normal instruction execution throughout the processor pipeline. This continuous validation approach maintains constant security monitoring without interrupting the instruction stream, ensuring measurement precision while avoiding speed penalties through parallel operation
Solution Approach 2:
The patent creates duplicate copies of control flow signature validation logic within the processor pipeline, allowing validation operations to occur simultaneously with instruction execution. Multiple copies of the validation circuitry process different pipeline stages in parallel, enabling precise measurement of execution integrity without becoming a sequential bottleneck that would reduce processing speed
3Difficulty of detecting and measuring
If comprehensive control flow monitoring is implemented, then ability to detect attacks is improved, but loss of time for validation operations increases
Solution Approach 1:
The patent pre-computes and stores control flow signatures for all possible execution paths during program compilation or deployment, organizing them in optimized data structures for rapid lookup. This preliminary preparation eliminates the need for time-consuming computation during runtime validation, enabling comprehensive attack detection while minimizing validation overhead to negligible levels
Solution Approach 2:
The patent replaces time-consuming software-based control flow analysis with optimized hardware circuits that perform signature comparison in parallel with execution. The hardware implementation uses dedicated logic paths and parallel processing to validate control flow decisions instantaneously, detecting attacks comprehensively without introducing measurable time loss to the execution timeline
4Reliability
If validation checks are added to ensure memory safety and type safety, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal control flow signature validation mechanism that simultaneously enforces multiple security properties including memory safety, type safety, and authorization constraints through a single unified hardware circuit. This multi-functional approach validates all these properties by comparing control flow signatures against expected patterns, improving comprehensive reliability while avoiding the complexity of separate validation systems for each security property
Data Source
AI summary
A processor comprising: an instruction processing pipeline, configured to receive a sequence of instructions for execution, said sequence comprising at least one instruction including a flow control instruction which terminates the sequence; a hash generator, configured to generate a hash associated with execution of the sequence of instructions; a memory configured to securely receive a reference signature corresponding to a hash of a verified corresponding sequence of instructions; verification logic configured to determine a correspondence between the hash and the reference signature; and authorization logic configured to selectively produce a signal, in dependence on a degree of correspondence of the hash with the reference signature.