CPU Branch Instruction Verification Unit for Secure Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting information processors from computer viruses and hacking attacks rely on vaccine programs, which are ineffective until new virus characteristics are identified and incorporated, and fail to address control flow attacks that manipulate branch instructions.
Innovation Solution
A central processing unit (CPU) with a branch instruction verification unit that checks the validity of branch instructions using a lookup table (LUT) or hash functions, preventing execution of malicious instructions without relying on vaccine programs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vaccine programs are used to detect and protect against computer viruses, then protection against known viruses is achieved, but protection against new viruses and control flow attacks is impossible until updates are applied
Solution Approach 1:
The system pre-establishes a trusted codebase during a safe state, creating a baseline of valid branch instructions before any potential attacks occur. This preliminary action enables immediate detection of malicious code without requiring time-consuming updates or analysis when new threats emerge.
Solution Approach 2:
The invention proactively prevents control flow attacks by verifying branch instructions against the trusted codebase before execution, rather than reactively responding to detected threats. This preliminary anti-action blocks malicious code execution at the source, eliminating the time lag inherent in traditional vaccine program updates.
2Difficulty of detecting and measuring
If traditional virus detection methods are used, then simple virus detection is possible, but control flow attacks manipulating branch instructions cannot be detected
Solution Approach 1:
The system segments the codebase into individual branch instruction elements and verifies each one against the trusted codebase. This segmentation approach allows detection of subtle manipulations in branch instructions that traditional holistic virus detection methods miss, while maintaining broad adaptability to various attack types.
Solution Approach 2:
The invention replaces the mechanical pattern-matching approach of traditional virus detection with a cryptographic verification system. By substituting hash-based verification for signature-based detection, the system achieves both high detection capability for subtle manipulations and universal adaptability to all control flow attack variants.
3Productivity
If the CPU executes all branch instructions without verification, then processing speed is maintained, but malicious code execution cannot be prevented
Solution Approach 1:
The CPU performs self-verification of branch instructions by checking them against the trusted codebase stored in memory. This self-service mechanism enables the processor to autonomously detect and block malicious code without external intervention, maintaining high execution speed while preventing harmful code execution.
Solution Approach 2:
The trusted codebase stored in memory serves as an intermediary between the branch instruction and the execution unit. This intermediary layer verifies the legitimacy of each branch instruction before it reaches the execution unit, blocking malicious code while allowing legitimate instructions to pass through with minimal delay.
Data Source
AI summary
Provided are a central processing unit (CPU) and method for executing a branch instruction of a CPU, which can protect user's data by preventing an error due to a computer virus and a hacker is provided. The CPU includes: a branch instruction verification unit which verifies whether a branch instruction is valid; and a branch instruction execution unit which executes the branch instruction when the branch instruction is valid. The method includes: verifying whether the branch instruction is valid; and not executing the branch instruction when the branch instruction is invalid.