Verifying Instruction Execution Protection Architecture Operation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is no conventional mechanism to test the proper operation of the Instruction Execution Protection (IEP) architecture, which is critical for preventing data execution in memory and ensuring system security, especially in uniprocessor and multiprocessor environments.
Innovation Solution
A test system that selectively sets IEP bits in page tables to prevent code execution in designated storage blocks, detects IEP exceptions, and determines test results to verify the correct operation of IEP, allowing for remedial actions based on the outcomes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IEP bits are set in page tables to prevent data execution, then system security is improved, but there is no mechanism to verify proper operation of IEP
Solution Approach 1:
The patent introduces a page walker as an intermediary component that systematically traverses page tables and checks IEP bit settings. This mediator verifies whether the IEP architecture is functioning correctly by attempting to execute instructions in protected memory regions and confirming that execution is properly blocked when IEP bits are set, thus solving the verification problem without compromising security
Solution Approach 2:
The system performs self-verification by using its own page table structure and IEP mechanism to test itself. The page walker utilizes the existing IEP infrastructure to conduct integrity checks on the IEP implementation, allowing the system to autonomously verify its security functionality without requiring external testing apparatus
2Object-affected harmful factors
If IEP architecture is implemented to prevent execution of data in memory, then protection against malicious programs is improved, but testing capability of IEP operation is degraded
Solution Approach 1:
The verification process is segmented into distinct operational phases: setting IEP bits in page tables, attempting execution in protected regions, detecting execution attempts, and recording results. This segmentation allows comprehensive testing of IEP functionality while maintaining the integrity of the protection mechanism in production environments
Solution Approach 2:
The system dynamically changes the state of IEP bits in page tables during testing to create different test scenarios. By modifying these parameters (setting and clearing IEP bits), the system can verify both protected and unprotected execution paths, ensuring comprehensive coverage of IEP functionality without permanent impact on system security
Data Source
AI summary
A computer-implemented method includes executing one or more tests on a computing device. The computing device has Instruction Execution Protection (IEP), and each test of the one or more tests includes selectively setting one or more IEP bits of one or more page tables, where each IEP bit prevents code in a respective storage block from being executed. During the one or more tests, an IEP exception is detected, by a computer processor, each time an attempt is made to execute code in a storage block for which a respective IEP bit is set. Test results of the one or more tests are determined based on the detecting. A remedial action is performed in response to the test results of the one or more tests.