Phantom Name System for Code-Reuse Attack Mitigation

The patent implements dynamic address assignment where each instruction or basic block is assigned multiple virtual addresses (phantom addresses) that change over time. During execution, a random phantom address is selected for each instruction fetch, making the target addresses of control flow instructions unpredictable. This dynamic addressing scheme thwarts code-reuse attacks while maintaining minimal performance overhead since the phantom address selection is integrated into the normal instruction fetch process without requiring additional mitigation steps.

The patent changes the addressing parameter by introducing phantom addresses as an additional layer of indirection between the physical instruction location and the virtual address used for execution. Instead of using a single fixed or randomized base address (as in ASLR), the system uses multiple phantom addresses per instruction that are selected randomly at runtime. This parameter change creates exponential complexity for attackers who would need to guess not just the base address but also the specific phantom address for each instruction in the attack chain.

The patent makes the existing program counter (PC) and address generation logic multi-functional by enabling it to handle both normal sequential execution addresses and phantom addresses for security. The same PC increment logic and address calculation units used for standard instruction fetching are also used to generate and select phantom addresses, eliminating the need for separate dedicated hardware structures for address management. This universal use of existing components minimizes hardware complexity while implementing the phantom addressing scheme.

The system uses its own existing address generation and selection mechanisms to create and manage phantom addresses, rather than requiring external or separate hardware components. The random number generator and address calculation logic that already exist in the processor are repurposed to generate phantom addresses, and the normal address translation and selection infrastructure serves dual purposes for both standard execution and security-hardened execution. This self-service approach avoids adding significant hardware complexity.