Tagged Processor Architecture for Control-Flow and Pointer Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software is vulnerable to control-flow attacks, and existing tagged architectures either provide insufficient protection or incur significant performance overhead due to wide metadata tags.
Innovation Solution
A secure tagged processor (SP) with 32-bit tags for each instruction and datum, utilizing a Tagged Management Unit (TMU) to enforce security policies, and a metadata processing unit to manage tags concurrently with the CPU, along with a bus arbiter to ensure components are owned by the same entity, and memory mapped records for tag assignment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If wide metadata tags (e.g., 64-bit) are used to provide comprehensive security mechanisms, then protection against control-flow attacks is improved, but performance overhead and storage requirements increase significantly
Solution Approach 1:
The patent segments the tag structure into two parts: a narrow runtime tag (e.g., 16 bits) stored in memory with the data, and a wider compile-time tag (e.g., 64 bits) stored separately in a tag store. The runtime tag contains the most critical security information needed for fast validation, while the full tag information is available in the tag store when needed. This segmentation allows fast security checks with minimal overhead while maintaining comprehensive security coverage.
Solution Approach 2:
The patent introduces a new dimension to tag storage by separating the tag into two spatial dimensions: one in memory with the data (narrow tag) and another in a dedicated tag store (wide tag). This dimensional separation allows the system to access only the essential narrow tag for routine operations, achieving fast performance, while the full wide tag remains available in the tag store for comprehensive security validation when needed.
2Productivity
If narrow tags (e.g., 1-bit) are used to minimize overhead, then performance is improved, but the ability to distinguish between different control flow edges and provide sophisticated security mechanisms is reduced
Solution Approach 1:
The patent segments the tag information into a compact runtime portion and an extended compile-time portion. The runtime tag (narrow) contains essential security attributes for fast validation during execution, while the full tag (wide) stored in the tag store contains comprehensive security information including detailed control flow edge identification and sophisticated security policies. This segmentation enables the system to achieve both fast performance and rich security mechanisms.
Solution Approach 2:
The patent introduces a tag store as an intermediary structure that bridges between the narrow runtime tag and the comprehensive security requirements. The tag store acts as a mediator that provides full tag information when needed for sophisticated security checks, while allowing the narrow runtime tag to handle routine operations efficiently. This intermediary enables the system to access detailed security information without paying the full overhead continuously.
3Reliability
If comprehensive tag information is stored with every datum to enable rigorous security checks, then control flow integrity is improved, but memory requirements and storage overhead increase
Solution Approach 1:
The patent segments tag storage into two parts: a compact runtime tag stored in memory with each datum (minimal space), and a comprehensive wide tag stored in a separate tag store. This segmentation allows the system to maintain control flow integrity through the narrow runtime tag while keeping memory overhead minimal. The full tag information is available in the tag store when needed for comprehensive security validation, but does not increase working memory requirements.
Solution Approach 2:
The patent moves comprehensive tag information to a separate dimensional space (the tag store) rather than storing it inline with every datum in memory. This dimensional change allows the system to have full tag information available for control flow integrity checks without increasing the memory footprint of the working data. The tag store serves as a dedicated storage dimension for comprehensive tag information.
Data Source
AI summary
Control flow attacks exploit software vulnerabilities to divert the flow of control into unintended paths to ultimately execute attack code. Instruction and data tagging is used to thwart such control flow attacks, including violations of pointer integrity. Narrow-width data tags along with narrow-width instruction tags interspersed with the instructions and data facilitates security policies. Co-locating instruction tags close to their corresponding instructions within cache lines eliminates the need for separate mechanisms for tag accesses. The tags are generated based on analysis during compilation.