Method for securing at least one memory zone of an electronic device, corresponding securing module, electronic device and computer program

Patent metadata

Field	Value
Publication number	US-10795808-B2
Application number	US-201616063028-A
Country	US
Kind code	B2
Filing date	Dec 12, 2016
Priority date	Dec 15, 2015
Publication date	Oct 6, 2020
Grant date	Oct 6, 2020

Abstract

A method for securing at least one memory zone of an electronic device. The method includes: detecting deallocation of at least one portion of the memory zone, a so-called deallocated portion; replacing at least one part of the deallocated portion with at least one predetermined instruction, a so-called warning instruction, or at least one combination of predetermined instructions, a so-called warning instruction combination; and marking the deallocated portion.

First claim

The invention claimed is:

1. A method for securing at least one memory zone of an electronic device, wherein the method comprises the following acts:
detecting a deallocation, when it occurs, of at least one portion of said memory zone, called a deallocated portion;
in response to the detecting, replacing at least one part of said deallocated portion with at least one predetermined instruction, called an alert instruction, or at least one combination of predetermined instructions, called a combination of alert instructions;
marking said deallocated portion to deliver a marked memory zone according to different types of marking; and
a preliminary act of determining a size of said deallocated portion, and:
when said determined size is below a predetermined threshold, said replacing act replaces all the bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, and said marking delivers a secured marked memory zone; and
when said determined size is above a predetermined threshold, said replacing act replaces at least the n first and the m last bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, with n and m being predetermined integers greater than zero, and said marking delivers an unsecured marked memory zone.

2. The method for securing according to claim 1 wherein, when said determined size is above the predetermined threshold, said method for securing comprises:
a predetermined number of iterations of said replacing act, said predetermined number of iterations being adapted to replacing all the bytes of said deallocated portion, and,
when all the bytes of said deallocated portion are replaced, an act of modifying the marking of said deallocated portion delivering the secured marked memory zone.

3. The method for securing according to claim 1 , further comprising a preliminary act of writing, to at least one protected memory zone of said electronic device distinct from said memory zone to be secured, of at least one alerting program executed via execution of said alert instruction or combination of alert instructions.

4. The method for securing according to claim 3 , wherein said alert instruction or said combination of alert instructions corresponds to a jump towards said alerting program.

5. The method for securing according to claim 3 , wherein said alerting program generates an alert of the type consisting of:
a sound signal emitted by said electronic device;
a visual signal emitted by said electronic device;
a deactivation of at least one part of said electronic device; or
a combination of at least two of said types of alert.

6. The method for securing according to claim 1 , wherein a secured memory zone marked as being secured can be allocated and a memory zone marked as being unsecured cannot be allocated and wherein an unmarked memory zone is allocated by priority over a memory zone marked as being secured.

7. A module for securing at least one memory zone of an electronic device, wherein the module comprises:
a processor configured to:
detect a deallocation, when it occurs, of at least one portion of said memory zone, called a deallocated portion;
in response to detecting the deallocation, replace at least one part of said deallocated portion by at least one predetermined instruction, called an alert instruction, or at least one predetermined combination of instructions, called a combination of alert instructions;
mark said deallocated portion to deliver a marked memory zone according to different types of marking; and
preliminarily determine a size of said deallocated portion, and:
when said determined size is below a predetermined threshold, said processor replaces all the bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, and said processor delivers a secured marked memory zone; and
when said determined size is above a predetermined threshold, said processor replaces at least the n first and the m last bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, with n and m being predetermined integers greater than zero, and said processor delivers an unsecured marked memory zone.

8. Electronic device comprising the module for securing according to claim 7 .

9. A non-transitory computer-readable medium on which there is stored a computer program comprising instructions execution of a method for securing at least one memory zone of an electronic device, when the instructions are executed by a processor, wherein the method comprises:
detecting a deallocation, when it occurs, of at least one portion of said memory zone, called a deallocated portion;
in response to the detecting, replacing at least one part of said deallocated portion with at least one predetermined instruction, called an alert instruction, or at least one combination of predetermined instructions, called a combination of alert instructions;
marking said deallocated portion to deliver a marked memory zone according to different types of marking; and
a preliminary act of determining a size of said deallocated portion, and:
when said determined size is below a predetermined threshold, said replacing act replaces all the bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, and said marking delivers a secured marked memory zone; and
when said determined size is above a predetermined threshold, said replacing act replaces at least the n first and the m last bytes of said deallocated portion by at least one alert instruction or at least one combination of alert instructions, with n and m being predetermined integers greater than zero, and said marking delivers an unsecured marked memory zone.

Assignees

• Ingenico Group

Inventors

• Naccache David
• Geraud Remi
• Koudoussi Hiba

Classifications

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F12/023 Primary

  Free address space management · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title