Hardware Decryption Circuitry for Multi-Core Processor Buffer Overflow Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods to mitigate buffer overflow attacks (BOAs) in digital processors are insufficient, as they often rely on software-based solutions that consume significant computing resources and have not completely eliminated the risk of malicious code execution, particularly in multi-core processors where encryption and decryption processes become complex and power-intensive.
Innovation Solution
Implementing a hardware-based solution that encrypts processor instructions using a Seed Value and decryption circuitry, where instructions are decrypted just before execution and re-encrypted upon storage, with the decryption process being irreversible except through a processor reset, and placing encryption and decryption circuitry in the External Memory Interface or between cache levels to reduce core complexity and power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based solutions are used to mitigate buffer overflow attacks, then security protection is provided, but computing resources are significantly consumed
Solution Approach 1:
The patent replaces software-based security solutions with hardware-based encryption circuitry integrated into the processor. Encryption and decryption operations are performed by dedicated hardware circuits (encryption circuit 301a and decryption circuit 301b) rather than software routines, significantly reducing the computational overhead and resource consumption while maintaining security protection against buffer overflow attacks
Solution Approach 2:
The patent introduces encryption circuitry as an intermediary component between the memory interface and the processor cores. This intermediary performs automatic encryption of instructions during write operations and decryption during read operations, providing security protection without requiring the processor cores themselves to consume additional computing resources for encryption/decryption tasks
2Reliability
If encryption circuitry is placed in each processor core, then security is enhanced, but device complexity and power consumption increase
Solution Approach 1:
The patent segments the encryption functionality from the processor cores and places it in the external memory interface. This separates the security function into a dedicated component, reducing the complexity of each individual core while maintaining overall system security through centralized encryption/decryption operations in the memory interface
Solution Approach 2:
The patent makes the external memory interface universal by giving it the additional security function of encryption and decryption. The memory interface, which already handles all memory transactions for all cores, is enhanced with encryption circuitry that serves the entire multi-core processor system, eliminating the need for separate encryption circuits in each core
3Reliability
If instructions are decrypted just before execution, then security is maintained without frequent resets, but power consumption increases
Solution Approach 1:
The patent implements continuous encryption protection by encrypting instructions at the time of writing to memory and decrypting them automatically when read for execution. This continuous encryption/decryption process eliminates security gaps that would exist between resets, ensuring that instructions remain protected throughout their entire lifecycle in memory without requiring frequent processor resets
Solution Approach 2:
The patent replaces the energy-intensive software-based decryption process with hardware-based decryption circuitry integrated into the memory interface. This hardware decryption occurs automatically as part of the memory read operation, minimizing additional power consumption while maintaining continuous security protection
Data Source
AI summary
Disclosed herein are methods and devices for defeating buffer overflow problems in multicore processors. In one embodiment, a processor implemented within a multicore processor integrated circuit (IC) is disclosed. The processor includes an instruction register and selection circuitry including a hardware latch operable to thwart a buffer overflow attack. The selection circuitry is electrically coupled with the instruction register. The selection circuitry is configured for: providing decrypted instructions to the instruction register when the hardware latch is in a first state and providing un-decrypted instructions to the instruction register when the hardware latch is in a second state. The coupling of the selection circuitry can be directly to the instruction register of a processor core, or indirectly by directing the output of the selection circuitry to cache memory inside the processor IC so that the instruction register only receives decrypted instructions from the cache memory.