Deallocated Memory Zone Security via Alert Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems with limited computation power, such as embedded systems and real-time operating systems, face challenges in protecting against unauthorized access to deallocated memory zones, which can lead to software attacks and data breaches, especially when countermeasures like virtual memory and segmentation protection are not available.
Innovation Solution
A method that detects deallocated memory zones, replaces them with alert instructions to trigger an alerting program upon access, and marks them for non-priority allocation, ensuring that unauthorized access is detected and prevented without impacting system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual memory and MMU are used to isolate processes and detect unauthorized memory access, then security against unauthorized access is improved, but device complexity and performance overhead increase significantly
Solution Approach 1:
The patent applies preliminary action by proactively replacing deallocated memory zones with alert instructions before any unauthorized access can occur. When memory is deallocated, the system immediately fills it with trap instructions that will execute an alert routine if accessed, preventing security breaches before they happen without requiring complex virtual memory structures.
Solution Approach 2:
The patent extracts the security function from complex hardware structures (MMU, virtual memory) and implements it as a simple software-based alert routine. By removing the need for hardware-assisted virtual memory and process isolation, the system achieves security through a lightweight software mechanism that monitors memory access patterns.
2Reliability
If virtual memory and process isolation are implemented to prevent unauthorized memory access, then security is improved, but system performance deteriorates due to costly translation operations
Solution Approach 1:
The system performs preliminary action by pre-filling deallocated memory with alert instructions before any access occurs. This proactive approach eliminates the need for real-time translation and access checking, as the alert instructions automatically trigger on any unauthorized access attempt, providing both security and performance.
Solution Approach 2:
The patent uses disposable alert instructions that are cheap to create and execute. These instructions are simple trap routines that can be rapidly deployed in deallocated memory zones and executed if accessed, providing an inexpensive security mechanism that does not burden system performance.
3Reliability
If operational constraints like code certification and verification are applied to limit attack vectors, then security is improved, but manufacturing cost and time increase
Solution Approach 1:
The system applies self-service by implementing automatic security monitoring through the alert routine that executes when unauthorized access occurs. The memory protection mechanism is self-monitoring and self-responding, eliminating the need for expensive external verification and certification processes while maintaining security.
Solution Approach 2:
The patent extracts security from complex verification and certification processes and implements it as a simple runtime alert mechanism. By removing the need for pre-certification and external verification, the system achieves security through an automated, low-cost software-based approach.
4Reliability
If segmentation protection is implemented to detect execution flow hijacking, then security is improved, but device complexity increases for systems with limited computation power
Solution Approach 1:
The system performs preliminary action by pre-installing alert instructions in deallocated memory zones before any hijacking attempt. This proactive placement of detection mechanisms eliminates the need for complex segmentation structures, as the alert instructions will automatically trigger if execution flow is redirected to protected zones.
Solution Approach 2:
The patent extracts the detection function from complex segmentation structures and implements it as simple alert instructions in deallocated memory. By removing the need for hardware segmentation and process isolation, the system achieves execution flow monitoring through lightweight software-based alert routines.
Data Source
AI summary
A method for securing at least one memory zone of an electronic device. The method includes: detecting deallocation of at least one portion of the memory zone, a so-called deallocated portion; replacing at least one part of the deallocated portion with at least one predetermined instruction, a so-called warning instruction, or at least one combination of predetermined instructions, a so-called warning instruction combination; and marking the deallocated portion.