Cryptographic Field Addresses for Intra-Object Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory safety mechanisms struggle to mitigate intra-object overflows and buffer overflows between different fields within the same object, leading to performance issues and incompatibilities with existing code, while approaches like Buf2Ptr and CHERI impose significant overheads and hardware requirements.
Innovation Solution
The proposed Cryptographic Capability Computing (C3) system encodes type and location information into Cryptographic Addresses (CAs) using new compiler instructions, allowing flexible pointer generation and encryption to ensure intra-object memory protection without substantial performance or hardware overheads, supporting legacy binaries and complex software systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Buf2Ptr approaches are used to split objects into distinct allocations for each field, then inter-object memory safety controls can be applied to isolate fields, but code incompatibilities are imposed and memory layout is drastically changed
Solution Approach 1:
The patent applies segmentation by dividing a compound object into multiple separate allocations, where each field becomes an independent object. This is achieved through the Buf2Ptr approach that splits the memory layout of compound structures into distinct heap allocations, allowing each field to be independently managed and protected by inter-object memory safety controls while maintaining the ability to access fields through offset calculations from a base pointer.
2Reliability
If Buf2Ptr approaches are used to split objects, then intra-object memory protection can be achieved, but multiple allocation calls are necessitated introducing performance overheads
Solution Approach 1:
The patent applies preliminary action by performing the segmentation and multiple allocation operations at compile-time or object construction time, rather than at runtime during field access. The compound object is pre-split into its constituent field allocations, and the relationships between fields are pre-computed and stored as metadata. This allows runtime field access to proceed efficiently using pre-calculated offsets and pointers without triggering additional allocation calls.
3Reliability
If CHERI capability architecture is used to encapsulate data types in extended pointers, then intra-object isolation can be provided, but pointer sizes are doubled imposing substantial storage overheads
Solution Approach 1:
The patent applies copying by creating a simplified software-based model of capability-like protection without adopting the full CHERI hardware architecture. Instead of using extended capability pointers with built-in isolation properties, the patent copies the essential protection functionality into software through separate allocations and offset-based field access control. This achieves similar intra-object isolation effects while maintaining standard pointer sizes and avoiding the 2x storage overhead of CHERI capabilities.
4Reliability
If Buf2Ptr approaches are used to fragment objects, then field-specific isolation is achieved, but ABI is broken by necessitating multiple field-specific pointers
Solution Approach 1:
The patent applies the intermediary principle by introducing a base pointer as a mediator that represents the entire compound object. Instead of requiring multiple field-specific pointers that would break ABI, a single base pointer is maintained that points to the start of the compound object's memory region. Field access is achieved by calculating offsets from this base pointer, allowing the compound object to be passed around as a single entity to functions while still providing field-level isolation through the offset-based access control mechanism.
Data Source
AI summary
Some aspects of the present disclosure relate to an apparatus comprising memory circuitry, machine-readable instructions, and processor circuitry to execute the machine-readable instructions to obtain a hash value being indicative of an object path of an object, determine specialization information being indicative of a location of a field of the object relative to the object, combine the hash value and the specialization information, and generate a cryptographic address of the field of the object, with the cryptographic address comprising the combination.