Encrypted Pointer Authentication for Secure Program Flow

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for securing pointers and branch instructions in processing systems are inadequate, leaving them vulnerable to malicious attacks that can redirect program flow or modify functionality.

Innovation Solution

Implementing encryption and authentication processes for pointers and branch instructions, including encryption of address bits, determination of authentication values, and combining these with encrypted bits to produce signed encrypted pointers and authenticatable branch instructions, using cryptographic techniques to obscure and secure the integrity of these elements.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If cryptographic signing is applied to pointers and branch instructions, then authentication capability is improved, but security against malicious attacks remains insufficient

Engineering Contradiction:

Improveauthentication capabilityVSAvoidvulnerability to malicious attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The pointer is divided into separate components: address bits and authentication bits. The authentication bits are generated independently based on the address bits using a cryptographic function, allowing the address and authentication to be segmented and processed separately while maintaining security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The authentication bits are calculated and combined with the address bits before the pointer is used in the program. This preliminary authentication action ensures that any modification to the pointer before execution will be detected, preventing malicious attacks in advance.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If pointer authentication bits are added to existing pointer structures, then security is improved, but device complexity increases

Engineering Contradiction:

Improvepointer securityVSAvoidpointer structure complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The authentication bits are merged with the address bits to form a unified pointer structure. The combination function integrates both components into a single data structure that can be handled as one entity, reducing the overhead of separate storage and processing mechanisms.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The pointer structure serves multiple functions: it stores the address information and simultaneously carries authentication information. This multi-functionality eliminates the need for separate authentication mechanisms, reducing overall system complexity while maintaining enhanced security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20260003800A1Methods and apparatus for pointer security

Publication Date: 2026.01.01 ARM LTD

AI summary

Aspects of the present disclosure relate to interface circuitry to receive a pointer comprising a plurality of address bits, and pointer processing circuitry. The pointer processing circuitry is configured to extract and encrypt plurality of address bits from the pointer, to produce a plurality of encrypted address bits. The pointer processing circuitry determines, based at least in part on the plurality of address bits, a pointer authentication value. It then combines the pointer authentication value with the plurality of encrypted address bits, to produce a signed encrypted pointer.