PROTECTION OF A VOLATILE MEMORY AGAINST VIRUSES BY MODIFICATION OF THE CONTENT OF AN INSTRUCTION

• US 20120284796A1
• Filed: 04/27/2012
• Published: 11/08/2012
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: STMicroelectronics SAS (STMicroelectronics NV)
• Original Assignee: STMicroelectronics SAS (STMicroelectronics NV)
• Inventors: TEGLIA, Yannick
• Granted Patent: US 9,286,470 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

A method for protecting a volatile memory against a virus, wherein: rights of writing, reading, or execution are assigned to certain areas of the memory; and a first list of opcodes for which the access to the areas is authorized or forbidden is associated with each of these areas.

Claims

1. A method for protecting a volatile memory against a virus, comprising, with at least one processor:

assigning rights of writing, reading, or execution to at least one area of the volatile memory; and

associating with the at least one area a first list of opcodes for which access to the at least one area is authorized or forbidden.

2. The method of claim 1, wherein the first list of opcodes is stored at the same address as the at least one area.

3. The method of claim 1, wherein the first list of opcodes is stored in a table separate from the at least one area.

4. The method of claim 1, wherein the volatile memory is a RAM.

5. The method of claim 1, wherein the volatile memory is a stack associated with a processing unit.

6. The method of claim 1, further comprising:

associating with the at least one area a second list of opcodes authorized or forbidden as a content of the at least one area.

13. The method of claim 1, wherein:

the first list of opcodes is stored in memory separate from the at least one area.

14. The method of claim 1, wherein:

the first list of opcodes indicates that an opcode of an instruction stored in the volatile memory is not authorized to access content of an area of the at least one area; and

when the virus attempts to modify an argument of the instruction comprising an address indicating the area, the virus is prevented from accessing the content of the area.

15. The method of claim 1, wherein:

the first list of opcodes is updated when a program is loaded into the volatile memory.

16. The method of claim 1, further comprising:

in response to detecting an attempt by the virus to access an area of the at least one area to which access is forbidden in accordance with at least one of the rights of writing, reading, or execution and the first list of opcodes, providing an indication to a user indicating the attempt.

7. An electronic circuit comprising:

a processing unit; and

memory storing computer-executable instructions that, when executed by the processing unit, perform a method for protecting a volatile memory against a virus, the method comprising;

assigning rights of writing, reading, or execution to at least one area of the volatile memory; and

associating with the at least one area a first list of opcodes for which access to the at least one area is authorized or forbidden.

8. The electronic circuit of claim 7, wherein:

the first list of opcodes is stored at the same address as the at least one area.

9. The electronic circuit of claim 7, wherein:

the first list of opcodes is stored in memory separate from the at least one area.

10. The electronic circuit of claim 7, wherein:

the volatile memory comprises an execution stack.

11. The electronic circuit of claim 7, wherein:

the first list of opcodes comprises at least one first opcode authorized to access the at least one area and at least one second opcode forbidden to access the at least one area.

12. The electronic circuit of claim 7, wherein the method further comprises:

associating with the at least one area a second list of opcodes that are authorized or forbidden to be stored in the at least one area.

17. A system for protecting a volatile memory against a virus, the system comprising:

a processing unit; and

the volatile memory comprising a plurality of areas, wherein;

at least one area of the plurality of areas is assigned rights of writing, reading, or execution; and

the at least one area is associated with a first plurality of opcodes which are authorized or forbidden to access the at least one area.

18. The system of claim 17, wherein:

the first list of opcodes is stored at the same address as the at least one area.

19. The system of claim 17, wherein:

the first list of opcodes is stored in storage separate from the at least one area.

20. The system of claim 17, wherein:

the at least one area is further associated with a second plurality of opcodes that are authorized or forbidden to be stored in the at least one area.