Domain-Based Instruction Access Control for Legacy Code Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in enhancing security, particularly when integrating legacy software that lacks function entry points with newer systems requiring these features, leading to significant overhead and infeasibility due to the need for complete system upgrades.
Innovation Solution
Implementing a memory address space with multiple domains and instruction access control circuitry that checks if a second instruction is permitted to execute after transitioning from a first domain, triggering an access violation response if not, thus providing a low-overhead security mechanism by requiring permitted instructions at call targets without needing specific branch instructions or labels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If function gating mechanisms and specific entry/exit opcodes are used to resist security attacks, then security is improved, but device complexity and code rewriting requirements increase significantly
Solution Approach 1:
The patent extracts the security checking functionality from complex function gating mechanisms and specific entry/exit opcodes, isolating it into a simpler runtime check that verifies whether a jump target contains executable code. This extraction reduces code complexity while maintaining security by focusing only on the essential security verification task.
Solution Approach 2:
Instead of requiring specific entry/exit opcodes and function gating mechanisms that enforce security through complex control flow restrictions, the patent inverts the approach by using a runtime check that verifies the target of indirect jumps contains executable code. This inversion simplifies the mechanism from proactive restriction to reactive verification.
2Adaptability or versatility
If published entry and exit points are made available at compile time across different software modules, then module interoperability is improved, but system upgrade requirements increase
Solution Approach 1:
The patent enables legacy code to work with the new security mechanism through self-service. The runtime check automatically determines whether indirect jump targets contain executable code without requiring any modifications to the legacy code itself. This self-service approach maintains module interoperability while avoiding the need for system-wide upgrades.
Solution Approach 2:
The patent applies partial action by implementing security checks only where needed - specifically at indirect jump targets - rather than requiring comprehensive modifications to all code. This selective application maintains interoperability with legacy modules while providing security where it matters most.
3Reliability
If checked jump instructions and cfi_register are added to CPU architecture for security control, then security is improved, but device complexity and integration difficulty with legacy software increase
Solution Approach 1:
The patent extracts the essential security verification function from complex checked jump instructions and cfi_register architecture, isolating it into a simpler runtime check that determines whether indirect jump targets contain executable code. This extraction maintains security while reducing architecture complexity.
Solution Approach 2:
Instead of modifying the CPU architecture with new instructions and registers, the patent copies the security verification functionality into software that runs on existing hardware. This software-based implementation achieves the same security effect without increasing device complexity or requiring architecture modifications.
4Reliability
If complete system upgrades are required to integrate legacy software with newer security features, then security consistency is improved, but productivity and feasibility decrease
Solution Approach 1:
The patent enables legacy code to work with the new security mechanism through self-service. The runtime check automatically determines whether indirect jump targets contain executable code without requiring any modifications to the legacy code itself. This self-service approach maintains security consistency while avoiding the need for system-wide upgrades.
Solution Approach 2:
The patent applies partial action by implementing security checks only where needed - specifically at indirect jump targets - rather than requiring comprehensive modifications to all code. This selective application maintains interoperability with legacy modules while providing security where it matters most.
Data Source
AI summary
Memory address space is divided into domains and instruction access control circuitry is used to detect when the memory address from which an instruction to be executed is fetched has crossed a domain boundary and changed and in such cases to conduct a check to ensure that the instruction within the new domain is a permitted instruction of a permitted form. The permitted instruction can be arranged to be a no operation instruction other than in respect of the instruction access control circuitry, in order to assist backward compatibility.