Protection of a non-volatile memory by change of instructions

• US 9,563,787 B2
• Filed: 03/03/2016
• Issued: 02/07/2017
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: STMicroelectronics SAS (STMicroelectronics NV)
• Original Assignee: STMicroelectronics SAS (STMicroelectronics NV)
• Inventors: Teglia, Yannick
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): Doan, Huan V
• Application Number:
  US15/060,159
• Publication Number:
  US 20160188900A1
• Time in Patent Office: 341 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1425 the protection being physical, e.g. cell, word, block
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

A method for protecting a volatile memory against a virus, wherein: rights of writing, reading, or execution are assigned to certain areas of the memory; and a first list of opcodes authorized or forbidden as a content of the areas is associated with each of these areas.

Claims

1. A method, comprising:

assigning rights of writing, reading, or execution to at least one area of a volatile memory, the at least one area being used to store instructions of at least one program;

associating, with the at least one area used to store instructions of the at least one program and assigned the rights of writing, reading, or execution, a first list of opcodes that are authorized or not authorized to be stored as content of the at least one area, the first list of opcodes being selected based on semantics of executed functions of the at least one program for which the at least one memory area is used;

in response to an attempt to store an opcode of an instruction in the at least one area of the volatile memory, determining, using at least one processor, whether the opcode of the instruction is indicated in the first list of opcodes as an opcode that is authorized to be stored in the at least one area of the volatile memory; and

performing, using the at least one processor, an action if it is determined that the first list of opcodes indicates that the opcode of the instruction is not authorized to be stored in the at least one area of the volatile memory, wherein the at least one program is a first program, and the method comprises;

in response to the at least one area being used for a second program different from the first program, associating the at least one area with a second list of opcodes selected based on semantics of executed functions of the second program, the second list of opcodes being different from the first list of opcodes.

2. The method of claim 1 wherein the volatile memory is a random access memory (RAM).

3. The method of claim 1, further comprising:

associating with the at least one area a second list of opcodes for which access to the at least one area is authorized or not authorized.

4. The method of claim 1, comprising:

updating the first list of opcodes when the at least one program is loaded into the volatile memory.

5. The method of claim 1 wherein the action is selected from a group comprising:

providing an indication to a user indicating the attempt, blocking an electronic circuit associated with the volatile memory, and blocking the instruction.

6. An electronic circuit comprising:

processing circuitry; and

memory storing computer-executable instructions that, when executed by the processing circuitry, perform a method for protecting a volatile memory against a virus, the method comprising;

assigning rights of writing, reading, or execution to at least one area of the volatile memory;

associating, with the at least one area being used to store instructions of at least one program and assigned the rights of writing, reading, or execution, a first list of opcodes that are authorized or not authorized to be stored as content of the at least one area, the first list of opcodes being selected based on semantics of executed functions of the at least one program for which the at least one memory area is used;

in response to an attempt to store an opcode of an instruction in the at least one area of the volatile memory, determining whether the opcode of the instruction is indicated in the first list of opcodes as an opcode that is authorized to be stored in the at least one area of the volatile memory; and

allowing the opcode of the instruction to be stored in the at least one area of the volatile memory if it is determined that the first list of opcodes indicates that the opcode of the instruction is authorized to be stored in the at least one area of the volatile memory wherein the at least one program is a first program, and the method comprises;

in response to the at least one area being used for a second program different from the first program, associating the at least one area with a second list of opcodes selected based on semantics of executed functions of the second program, the second list of opcodes being different from the first list of opcodes.

7. The electronic circuit of claim 6 wherein:

the volatile memory is a random access memory (RAM).

8. The electronic circuit of claim 6 wherein:

the first list of opcodes comprises at least one first opcode that is authorized as content of the at least one area and at least one second opcode that is not authorized as content of the at least one area.

9. A system, comprising:

processing circuitry; and

volatile memory comprising at least one area, which, in operation, stores instructions of at least one program, wherein;

the at least one area is associated with a first plurality of opcodes that are authorized or not authorized to be stored as content of the at least one area, the first plurality of opcodes being selected based on semantics of executed functions of the at least one program for which the at least one memory area is used; and

the processing circuitry, in operation;

responds to an attempt to store an opcode of an instruction in the at least one area of the volatile memory by determining whether the opcode of the instruction is indicated in the first list of opcodes as an opcode that is authorized to be stored in the at least one area of the volatile memory; and

allows the opcode of the instruction to be stored in the at least one area of the volatile memory if it is determined that the first list of opcodes indicates that the opcode of the instruction is authorized to be stored in the at least one area of the volatile memory wherein the at least one program is a first program, and the processing circuitry, in response to the at least one area being used for a second program different from the first program, associates the at least one area with a second plurality of opcodes selected based on semantics of executed functions of the second program, the second list of opcodes being different from the first list of opcodes.

10. The system of claim 9 wherein:

the second plurality of opcodes is a list of opcodes that are authorized or not authorized to access the at least one area.

11. A non-transitory computer-readable medium storing instructions which, when executed by processing circuitry, cause the processing circuitry to perform a method to protect a volatile memory against a virus, the method comprising:

assigning rights of writing, reading, or execution to at least one area of the volatile memory being used to store instructions of at least one program;

associating, with the at least one area being used to store instructions of at least one program and assigned the rights of writing, reading, or execution, a first list of opcodes that are authorized or not authorized to be stored as content of the at least one area, the first list of opcodes being selected based on semantics of executed functions of the at least one program for which the at least one memory area is used;

in response to an attempt to store an opcode of an instruction in the at least one area of the volatile memory, determining whether the opcode of the instruction is indicated in the first list of opcodes as an opcode that is authorized to be stored in the at least one area of the volatile memory; and

allowing the opcode of the instruction to be stored in the at least one area of the volatile memory if it is determined that the first list of opcodes indicates that the opcode of the instruction is authorized to be stored in the at least one area of the volatile memory wherein the at least one program is a first program, and the method comprises;

in response to the at least one area being used for a second program different from the first program, associating the at least one area with a second list of opcodes selected based on semantics of executed functions of the second program, the second list of opcodes being different from the first list of opcodes.

12. The non-transitory computer-readable medium of claim 11 wherein:

the volatile memory is a random access memory (RAM).

13. The non-transitory computer-readable medium of claim 11 wherein:

the first list of opcodes comprises at least one first opcode that is authorized as content of the at least one area and at least one second opcode that is not authorized as content of the at least one area.

14. The non-transitory computer-readable medium of claim 11 wherein the method comprises:

associating with the at least one area a second list of opcodes that are authorized or not authorized to access the at least one area.

15. The non-transitory computer-readable medium of claim 11 wherein the first list of opcodes is stored at the same address as the at least one area.

16. The non-transitory computer-readable medium of claim 11 wherein the first list of opcodes is stored in a table separate from the at least one area.

17. The non-transitory computer-readable medium of claim 11 wherein the at least one area is an instruction stack.