Enriched Pointer Authentication for Secure Program Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for executing computer programs are vulnerable to attacks based on erroneous pointer usage, particularly in contexts where data is encrypted and decrypted in blocks, as they require separate authentication codes for each datum, which is incompatible with block encryption/decryption techniques.
Innovation Solution
A method that uses enriched pointers with unique identifiers for each datum within a block, allowing for secure execution of computer programs by verifying the integrity and authenticity of blocks of data, while maintaining compatibility with block encryption/decryption, by employing a hardware security module to manage encryption, decryption, and authentication processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is encrypted and decrypted in blocks to accelerate transfers, then data transfer speed is improved, but separate authentication codes for each datum cannot be verified
Solution Approach 1:
The patent segments the authentication mechanism by introducing unique identifiers for each datum within a block, allowing individual datum authentication while maintaining block-based encryption/decryption efficiency. This segmentation enables the system to verify authentication codes for specific data items without requiring separate encryption operations for each datum.
Solution Approach 2:
The patent introduces an intermediary authentication structure that links unique identifiers with authentication codes at the datum level while operating within block-level encryption frameworks. This intermediary layer enables fine-grained authentication verification without compromising the performance benefits of block-based cryptographic operations.
2Ease of operation
If traditional pointer mechanisms are used for data access, then program execution simplicity is maintained, but the system becomes vulnerable to pointer-related attacks
Solution Approach 1:
The patent applies preliminary anti-action by preemptively verifying pointer validity through unique identifiers before data access operations occur. The system checks whether pointers reference legitimate data locations and validates authentication codes in advance, preventing stack overflow, use-after-free, and other pointer-related attacks before they can compromise system security.
3Reliability
If unique identifiers are added to pointers for security verification, then security against pointer attacks is improved, but data structure complexity increases
Solution Approach 1:
The patent merges the unique identifier with the pointer structure in a unified enriched pointer format, combining security functionality with existing pointer operations. This merging approach allows the system to maintain relatively simple data structures while incorporating authentication verification capabilities, avoiding excessive complexity by integrating security features into existing pointer mechanisms rather than adding separate complex verification layers.
Data Source
AI summary
A method for executing a computer program includes incorporating, into metadata of a block containing a line of code to be accessed using a pointer, a first pointer identifier associated with the line of code to be accessed, then obtaining a pointer including a first range of bits containing the address of the line of code to be accessed, and a different second range of bits containing a second pointer identifier, then verifying that the second pointer identifier contained in the obtained pointer corresponds to the first pointer identifier associated with the line of code to be accessed and contained in the metadata of the loaded block, and when the first and second pointer identifiers do not correspond, then the security module triggers signaling of an execution fault.