Random Tag Setting for Guard-Tagged Memory Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory-related errors in compiled code, particularly in memory-unsafe languages like C and C++, are prevalent and vulnerable to exploitation, leading to unpredictable behavior and potential attacks, as these languages lack runtime error detection checks.
Innovation Solution
Incorporating a guard tag system within the instruction set architecture, where a random tag setting instruction randomly selects a tag value for memory locations, enhancing error detection and making it harder for attackers to exploit memory access errors across a population of devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If guard tags are used to detect memory access errors, then error detection capability is improved, but the system complexity increases due to additional hardware components and operations
Solution Approach 1:
The system performs preliminary actions by setting guard tags in advance before memory access occurs. The guard tag is established as part of the memory block structure, and the address tag is set before the actual memory access operation, enabling error detection to be performed automatically during the access without requiring additional complex runtime checking mechanisms.
Solution Approach 2:
The memory access circuitry performs self-service by automatically comparing the address tag with the guard tag during each memory access operation. This built-in comparison mechanism eliminates the need for separate error detection hardware or software routines, as the detection function is integrated into the standard memory access path itself.
2Object-affected harmful factors
If deterministic tag values are used for memory locations, then system predictability is improved, but vulnerability to attacks increases as attackers can exploit predictable patterns
Solution Approach 1:
The system transitions from static, deterministic tag values to dynamic, random tag values. The random tag setting instruction enables the address tag to be assigned a random value from a set of candidate values, making the tag assignment non-deterministic. This dynamic approach ensures that even if the same memory location is accessed multiple times, the tag values will differ, thereby preventing attackers from exploiting predictable patterns.
Solution Approach 2:
The system changes the parameter of tag value assignment from fixed/deterministic to random/variable. By using a random tag setting instruction that selects from multiple candidate values, the system introduces variability in the tag parameter, making it impossible for attackers to predict which tag value will be assigned to which memory location, thus neutralizing exploitability.
3Object-affected harmful factors
If random tag values are assigned to memory locations, then attack resistance is improved, but the complexity of tag management increases
Solution Approach 1:
The system performs preliminary action by pre-defining a set of candidate tag values that can be randomly selected. This predefined set eliminates the need for complex runtime tag generation algorithms, as the random selection is performed from a predetermined collection of valid tag values, simplifying the management overhead while maintaining attack resistance.
4Reliability
If runtime error detection checks are implemented, then memory safety is improved, but execution time increases due to additional checking operations
Solution Approach 1:
The memory access circuitry performs self-service by automatically comparing the address tag with the guard tag during the standard memory access operation. This integrated approach means that error detection occurs as a byproduct of the normal access process, without requiring separate runtime checking operations that would add significant time overhead. The detection function is executed concurrently with the memory access itself.
Data Source
AI summary
An apparatus has processing circuitry (4); memory access circuitry (15) to perform a guard tag check for a tag checking target address having an associated address tag, the guard tag check comprising comparing the address tag with a guard tag stored in a memory system in association with a block of one or more memory locations comprising an addressed location identified by the target address; and an instruction decoder (6) responsive to a random tag setting instruction specifying a tag setting target address, to control the processing circuitry (4) to set the address tag associated with the tag setting target address to a random tag value randomly selected from a set of candidate tag values.