Protected Pointer Validation via Allocation Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital computer systems are vulnerable to malicious attacks and inadvertent errors that can modify executable code or access critical data, leading to security breaches and faults, particularly due to unvalidated pointers and incomplete garbage collection procedures.
Innovation Solution
The implementation of additional hardware and firmware support for code securitization and validation, including new opcodes for generating unique allocation identifiers for memory areas, associating these identifiers with pointers, and using a multi-input associative cache to quickly validate pointer validity and invalidate pointers when memory areas are deallocated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory management without validation is used, then system performance and simplicity are maintained, but security vulnerabilities and reliability issues arise from unvalidated pointers
Solution Approach 1:
The system performs preliminary actions by generating unique allocation identifiers and associating them with pointers during memory allocation. This advance preparation enables automatic validation without adding complexity to the pointer usage phase, as the validation data structure is already in place before pointers are used.
Solution Approach 2:
A validation data structure acts as an intermediary between the memory management system and pointer validation. This intermediary layer handles the complexity of tracking and validating pointers, allowing the rest of the system to use pointers without direct complexity while maintaining high reliability through automated validation checks.
2Object-affected harmful factors
If manual pointer validation is implemented, then security against malicious attacks improves, but system performance decreases due to validation overhead
Solution Approach 1:
The validation system performs self-service by automatically checking pointer validity against the validation data structure without requiring manual intervention or complex validation logic in application code. The system serves its own validation needs through automated mechanisms, reducing the burden on applications while maintaining strong security.
Solution Approach 2:
Manual pointer validation mechanics are replaced with automated hardware-assisted validation mechanisms. The validation data structure and associated hardware provide automatic validation, substituting the need for manual validation routines and reducing the performance overhead associated with software-based validation approaches.
3Reliability
If comprehensive pointer tracking is implemented, then garbage collection reliability improves, but memory overhead and system complexity increase
Solution Approach 1:
The validation data structure implements local quality by storing validation information in a targeted, efficient manner rather than duplicating full pointer metadata throughout the system. Each entry in the validation data structure contains only the essential allocation identifier needed for validation, reducing overall memory overhead while maintaining comprehensive tracking capability.
Solution Approach 2:
The validation data structure serves multiple functions: it enables pointer validation, supports garbage collection tracking, and provides allocation information. This multi-functionality reduces the need for separate data structures for each purpose, thereby reducing total memory overhead while improving garbage collection reliability through unified tracking.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A data processing machine is configured to automatically keep track of hypervisor given pointers pointing to respective and newly allocated areas of memory and to automatically keep track of corresponding copies or derivatives of the given pointers. A unique allocation identifier is generated for each newly allocated area. The allocation identifier is appended to a valid ID's holding list. All pointers pointing to the allocated area are tracked by a protected pointers tracking table. Additionally, a multi-input associative cache stores entries for recently used ones of the protected pointers where the entries include the respective allocation identifiers of the pointers. All pointers to a given, de allocated area can be invalidated by deleting their entries form the multi-input associative cache and by deleting the corresponding unique allocation identifier from the valid ID's holding list.