Method and apparatus to prevent vulnerability to virus and worm attacks through instruction remapping

• US 20050188171A1
• Filed: 02/19/2004
• Published: 08/25/2005
• Est. Priority Date: 02/19/2004
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: McIntosh, Gordon D.
• Granted Patent: US 7,493,483 B2
• Time in Patent Office: Days
• US Class Current: 711/200
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 9/30145 Instruction analysis, e.g. decoding, instruction word fields
• CPC Class Codes: G06F 9/3017 Runtime instruction translation, e.g. macros
• CPC Class Codes: G06F 9/30174 for non-native instruction set, e.g. Javabyte, legacy code
• CPC Class Codes: G06F 9/30196 using decoder, e.g. decoder per instruction set, adaptable or programmable decoders

Abstract

A method, apparatus, and computer instructions for processing instructions by a processing unit. An instruction set is dynamically set for the processing unit using a selected instruction map. The selected instruction map is selected as one being different from a normal instruction map for the processing unit. The instructions are processed at the processor using the instruction set. A set of authorized instructions are encoded using the selected instruction map.

Claims

1. A method in a data processing system for processing instructions by a processing unit, the method comprising:

dynamically setting an instruction set for the processing unit using a selected instruction map, wherein the selected instruction map is selected as one being different from a normal instruction map for the processing unit; and

processing the instructions at the processor using the instruction set, wherein a set of authorized instructions are encoded using the selected instruction map.

2. The method of claim 1, wherein a new instruction map is selected each time the data processing system is started.

3. The method of claim 1, wherein the instruction map is an opcode map.

4. The method of claim 1 further comprising:

encoding a set of instructions from a trusted computer base using the selected instruction map to form a set of encoded instructions; and

sending the set of encoded instructions to the processing unit for execution.

5. The method of claim 1, wherein the processing unit is at least one processor.

6. The method of claim 4, wherein the encoding step and the sending step are performed by a program loader.

7. The method of claim 1 further comprising:

responsive to an event, executing a process to select the selected instruction map.

8. The method of claim 7, wherein the process uses a machine serial number and a number of boot cycles to select the selected instruction map.

9. The method of claim 7, wherein the event is at least one of an initialization of the data processing system and a user input.

10. The method of claim 1, wherein the selected instruction set is set using a first selected instruction map when code is executed by a first privilege level and wherein a second selected instruction map is used as the instruction set for the processing unit when code is executed by a second privilege level.

11. A computer program product in a computer readable medium for processing instructions by a processing unit in a data processing system, the computer program product comprising:

first instructions for dynamically setting an instruction set for the processing unit using a selected instruction map, wherein the selected instruction map is selected as one being different from a normal instruction map for the processing unit; and

second instructions for processing the instructions at the processor using the instruction set, wherein a set of authorized instructions are encoded using the selected instruction map.

12. The computer program product of claim 11, wherein a new instruction map is selected each time the data processing system is started.

13. The computer program product of claim 11, wherein the instruction map is an opcode map.

14. The computer program product of claim 11 further comprising:

third instructions for encoding a set of instructions from a trusted computer base using the selected instruction map to form a set of encoded instructions; and

fourth instructions for sending the set of encoded instructions to the processing unit for execution.

15. The computer program product of claim 11, wherein the processing unit is at least one processor.

16. The computer program product of claim 14, wherein the third instructions and the fourth instructions are performed by a program loader.

17. The computer program product of claim 11 further comprising:

third instructions, responsive to an event, for executing a process to select the selected instruction map.

18. The computer program product of claim 17, wherein the process uses a machine serial number and a number of boot cycles to select the selected instruction map.

19. The computer program product of claim 17, wherein the event is at least one of an initialization of the data processing system and a user input.

20. The computer program product of claim 11, wherein the selected instruction set is set using a first selected instruction map when code is executed by a first privilege level and wherein a second selected instruction map is used as the instruction set for the processing unit when code is executed by a second privilege level.

21. A data processing system for processing instructions by a processing unit, the data processing system comprising:

dynamically setting means for dynamically setting an instruction set for the processing unit using a selected instruction map, wherein the selected instruction map is selected as one being different from a normal instruction map for the processing unit; and

processing means for processing the instructions at the processor using the instruction set, wherein a set of authorized instructions are encoded using the selected instruction map.

22. The data processing system of claim 21, wherein a new instruction map is selected each time the data processing system is started.

23. The data processing system of claim 21, wherein the instruction map is an opcode map.

24. The data processing system of claim 21 further comprising:

encoding means for encoding a set of instructions from a trusted computer base using the selected instruction map to form a set of encoded instructions; and

sending means for sending the set of encoded instructions to the processing unit for execution.

25. A data processing system comprising:

a bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes a set of instructions to dynamically set an instruction set for the processing unit using a selected instruction map, wherein the selected instruction map is selected as one being different from a normal instruction map for the processing unit; and

process the instructions at the processor using the instruction set, wherein a set of authorized instructions are encoded using the selected instruction map.