Processing Unit Instruction Permutation Against Remote Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing remote code execution on processing units are complex, expensive, and require significant modifications to the operating system or hardware, making them impractical and vulnerable to systemic errors.
Innovation Solution
A method and apparatus that permute the instruction set of a processing unit by hard-wiring or microcode, ensuring each unit has a unique bit order, rendering remote code execution exploits ineffective by causing exceptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If instruction set randomization is implemented using configurable encryption (e.g., XOR encryption with 32-bit key), then protection against remote code execution is improved, but device complexity and manufacturing cost increase significantly
Solution Approach 1:
The patent applies parameter changes by modifying the instruction set parameters through permutation of bit positions within instructions. Instead of using encryption algorithms, the invention changes the positional parameters of instruction bits to create a unique instruction set for each processing unit, thereby protecting against remote code execution without adding complex encryption logic.
Solution Approach 2:
The patent extracts the encryption logic from the system and replaces it with a simpler permutation mechanism. By removing the need for configurable encryption algorithms and keys, the invention reduces device complexity while maintaining the core functionality of instruction set randomization for security purposes.
2Reliability
If processing units are customized with unique instruction set permutations, then remote code execution prevention is improved, but ease of manufacture deteriorates due to hardware adaptation requirements
Solution Approach 1:
The patent applies preliminary action by determining the instruction set permutation during the manufacturing process itself, rather than requiring post-manufacturing configuration. The unique permutation is established as part of the hardware customization, which simplifies the overall manufacturing workflow despite the need for unique configurations.
Solution Approach 2:
The patent applies local quality by implementing the permutation specifically in the data path between memory and instruction decoder, rather than modifying the entire processing unit architecture. This localized approach minimizes the scope of hardware adaptations required while achieving the security objective.
3Reliability
If a unique permutation is hard-wired in the data path from memory to instruction decoder, then protection effectiveness is improved, but device complexity increases
Solution Approach 1:
The patent applies universality by designing the permutation mechanism to be integrated into the existing data path infrastructure. The same data path that normally transfers instructions from memory to decoder is used to apply the permutation, making the existing structure serve multiple functions: normal instruction transfer and security permutation.
Data Source
Figure 1~2
Figure 3~5
AI summary
The present invention is related to a method, a computer program code, and an apparatus for customizing a processing unit, in particular to prevent remote code execution of the processing unit. The invention is further directed towards a processing unit that has been customized with such a method or apparatus. In a first step, a permutation of an instruction set of the processing unit is determined (S1). Adaptations of the processing unit for implementing the permutation of the instruction set are then determined (S2). Finally, the processing unit is customized (S3) in accordance with the determined adaptations.