Redundant Branch Processor for Code Injection Detection

Solution Overview

Problem

Existing pipelined processor architectures face inefficiencies and high power consumption in detecting and preventing code injection attacks, as current methods require duplicating processors and comparing results, leading to excessive computational and hardware overhead.

Innovation Solution

A secure processor architecture is introduced, featuring a primary core processor and a redundant branch processor, where the primary core processor handles memory access, compute, and address arithmetic instructions, while the redundant branch processor executes only branch initialization and control instructions, with both processors outputting branch status for comparison by a fault detector to generate a fault detection output.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full processor duplication is used for code injection detection, then detection reliability is improved, but power consumption and hardware overhead increase excessively

Engineering Contradiction:

Improvecode injection detection reliabilityVSAvoidpower consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The processor is segmented into two specialized units: a primary processor that handles all general-purpose instructions, and a secondary processor that is dedicated exclusively to executing branch instructions. This segmentation allows the system to focus detection resources on the critical branch instruction subset, reducing the overall computational burden and power consumption while maintaining detection reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secondary processor is designed with specialized quality for handling only branch instructions, rather than duplicating full processor functionality. By concentrating detection capabilities on the specific instruction type (branch instructions) that is most vulnerable to code injection attacks, the system achieves effective detection with reduced hardware overhead and lower power consumption.

Inventive Principle:

Principle #3Local quality

2Reliability

If full processor duplication is used for code injection detection, then detection reliability is improved, but hardware overhead and computational inefficiency increase

Engineering Contradiction:

Improvecode injection detection reliabilityVSAvoidhardware overhead

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The processor is segmented into two specialized units: a primary processor that handles all general-purpose instructions, and a secondary processor that is dedicated exclusively to executing branch instructions. This segmentation allows the system to focus detection resources on the critical branch instruction subset, reducing the overall computational burden and power consumption while maintaining detection reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The secondary processor is designed with specialized quality for handling only branch instructions, rather than duplicating full processor functionality. By concentrating detection capabilities on the specific instruction type (branch instructions) that is most vulnerable to code injection attacks, the system achieves effective detection with reduced hardware overhead and lower power consumption.

Inventive Principle:

Principle #3Local quality

3Reliability

If all instructions are monitored for code injection, then detection completeness is improved, but computational overhead increases

Engineering Contradiction:

Improvedetection completenessVSAvoidcomputational efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The invention extracts and isolates branch instructions from the general instruction stream for dedicated processing and monitoring. By separating branch instruction execution into a specialized secondary processor, the system achieves focused detection of code injection attempts in the critical branch instruction subset without the computational overhead of monitoring all instruction types, thus maintaining detection completeness for attack vectors while preserving computational efficiency.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS12111913B2Core processor and redundant branch processor with control flow attack detection

Publication Date: 2024.10.08 CEREMORPHIC INC

AI summary

A secure processor with fault detection has a core thread which executes with a redundant branch processor thread. In one configuration, the core thread is operative on a fully functional core processor configured to execute a complete instruction set, and the redundant branch processor thread contains only initialization instructions and flow control instructions such as branch instructions and is operative on a redundant branch processor which is configured to execute a subset of the complete instruction set, specifically a branch control variable initialization and a branch instruction, thereby greatly simplifying the redundant branch processor architecture. Fault conditions are detected by comparing either a history of branch taken/not taken and branch targets, or a comparison of program counter activity for the core thread and redundant branch processor thread.