Techniques for metadata processing

Patent metadata

Field	Value
Publication number	US-10936713-B2
Application number	US-201616062791-A
Country	US
Kind code	B2
Filing date	Dec 12, 2016
Priority date	Dec 17, 2015
Publication date	Mar 2, 2021
Grant date	Mar 2, 2021

Abstract

Techniques are described for metadata processing that can be used to encode an arbitrary number of security policies for code running on a processor. Metadata may be added to every word in the system and a metadata processing unit nay be used that works in parallel with data flow to enforce an arbitrary set of policies. In one aspect, the metadata may be characterized as unbounded and software programmable to be applicable to a wide range of metadata processing policies. Techniques and policies have a wide range of uses including, for example, safety, security, and synchronization. Additionally, described are aspects and techniques in connection with metadata processing in an embodiment based on the RISC-V architecture.

First claim

What is claimed is:

1. A method of generating and using metadata tags comprising:
storing a bootstrap tag in a first specified register of a plurality of specified registers used in a metadata processing domain that is isolated from a code execution domain, the metadata processing domain being operative to determine whether to allow execution of a current instruction of the code execution domain in accordance with a set of one or more policies; and
performing first processing to derive one or more additional metadata tags from the bootstrap tag, wherein said first processing includes executing one or more instructions in the code execution domain that trigger metadata processing of one or more rules in the metadata processing domain.

2. The method of claim 1 , wherein the bootstrap tag is used an initial seed tag from which all other metadata tags, used by the metadata processing domain, are derived.

3. The method of claim 1 , wherein the bootstrap tag is hardwired or stored in a portion of read-only memory.

4. The method of claim 1 , wherein said storing and the first processing are included in processing performed by executing a first code portion of a bootstrap program when booting a system including the metadata processing domain and the code execution domain.

5. The method of claim 1 , further comprising:
deriving a default tag from the bootstrap tag stored in the first specified register;
storing the default tag in a second specified register of the plurality of specified registers; and

executing an instruction sequence triggering metadata processing of rules in the metadata processing domain that write the default tag from the second specified register as a metadata tag for each of a plurality of memory locations used by the code execution domain.

6. The method of claim 1 , wherein said performing the first processing includes generating an initial set of metadata tags derived from the bootstrap tag, wherein each of the metadata tags of the initial set is generated by executing a current instruction in the code execution domain that triggers rule cache miss processing in the metadata processing domain whereby no rule exists in the rule cache for the current instruction, the rule cache including rules on metadata used by the metadata processing domain to define allowed operations.

7. The method of claim 6 , wherein rule cache miss processing includes:
calculating, by a rule cache miss handler executing in the metadata processing domain, a new rule for the current instruction, wherein the new rule includes a result metadata tag of the initial set of metadata tags.

8. The method of claim 6 , wherein each metadata tag of the initial set is a tag generator that may be further used to derive other metadata tags.

9. The method of claim 8 , wherein execution of a first set of one or more specified instructions triggers rules and rule cache miss processing in the metadata processing domain that generates each metadata tag denoted as a tag generator used to generate a sequence of one or more other metadata tags, and wherein execution of a second set of one or more specified instructions triggers rules and rule cache miss processing in the metadata processing domain the generates each metadata tag denoted as a non-generating tag that cannot be used to further generate an additional metadata tag.

10. The method of claim 8 , wherein the initial set of metadata tags includes any one or more of:
an initial instruction metadata tag that is tag generator used to generate a sequence of one or more code tags used to tag instructions;
an initial malloc metadata tag that is a tag generator used to generate a sequence of one or more other malloc tag generators, wherein each of the one or more other malloc tag generators is used to generate a sequence of one or more other metadata tags for a different application in connection with coloring any of allocated memory cells and pointers to allocated memory cells used by the different application;
an initial control flow integrity tag that is a tag generator used to generate a sequence of one or more other control flow integrity tag generators, wherein each of the one or more other control flow integrity tag generators is used to generate a sequence of one or more other metadata tags for a different application in connection with tagging control transfer targets of the different application; and
an initial taint tag that is a tag generator used to generate a sequence of one or more other taint tag generators, wherein each of the one or more other taint tag generators is used to generate a sequence of one or more other metadata taint tags for a different application in connection with tagging data items that are used by the different application with a metadata taint tag based on code that produced or modified the data items.

11. The method of claim 6 , wherein the bootstrap program further includes instructions that trigger rules processed in the metadata processing domain that write one or more special metadata code tags on one or more instructions of designated code portions to provide an extended privilege, capability or authority to the tagged one or more instructions.

12. The method of claim 11 , wherein the designated code portions include one or more of kernel code and loader code.

13. The method of claim 11 , wherein the one or more special metadata code tags are derived from a first metadata tag of the initial set of metadata tags, wherein the first metadata tag is a special instruction tag generator.

14. The method of claim 1 , wherein a sequence of metadata tags is generated by executing instructions that trigger other processing of rules in the metadata processing domain, the other processing comprising:
generating a next metadata tag in the sequence using a current metadata tag in the sequence, wherein the current metadata tag denotes a current state of the sequence and is stored as a metadata tag associated with an atom, wherein the atom is any of a register or a memory location; and
updating the current state of sequence by saving the next metadata tag as the metadata tag associated with the atom.

15. A method of obtaining control flow information for an application comprising:
executing a loader that loads the application for execution by a processor, wherein said executing the loader includes executing a first code portion including one or more instructions that triggers metadata processing of a first set of one or more rules in a metadata processing domain, the metadata processing domain being operative to determine whether to allow execution of a current instruction of the code execution domain in accordance with a set of one or more policies, wherein said metadata processing of the first set of one or more rules includes collecting and storing the control flow information for the application as application metadata accessible to the metadata processing domain and inaccessible to a code execution domain; and
executing instructions of the application in the code execution domain, wherein said executing said instructions of the application triggers metadata processing of a second set of rules of a control flow policy that use at least a portion of the control flow information to determine whether to allow a transfer of control in the application from a first source location to a first target location.

16. The method of claim 15 , wherein the first target location has a set of one or more allowable source locations allowed to transfer control to the first target location.

17. The method of claim 16 , wherein said collecti

Assignees

• Charles Stark Draper Laboratory Inc

Inventors

• DEHON ANDRé
• Boling Eli

Classifications

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F9/3013

  according to data content, e.g. floating-point registers, address registers · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F9/4401

  Bootstrapping (security arrangements therefor G06F21/57) · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title