Patent ID: 11947663
Assignee: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. A computing system comprising:
one or more memory devices to implement a physical address space for the computing system; and
a controller configured to:
generate for a code block of a process executing on the computing system a code block replica defined at an address in a virtual address space of the computing system, wherein the code block of the process is stored in a particular segment of the physical address space of the computing system;
generate multiple phantom address names that all map to the code block replica in the virtual address space, each of the multiple phantom address names having a phantom space address that is based on a respective phantom offset (Δ) and a respective phantom security shift (δ), wherein random selection of any of the generated multiple phantom address names causes runtime-determined program control flow that mitigates code-reuse attacks requiring predictable runtime program control flow; and
for each group of one or more instructions, randomly select during runtime, when the code block of the process is to be processed, one of the multiple phantom address names based on which a program counter value is computed, wherein the randomly selected one of the multiple phantom address names is mapped into the code block replica in the virtual address space, with the code block replica to which the randomly selected one of the multiple phantom address names is mapped being subsequently translated to a physical address of the code block of the process;

wherein the controller configured to generate the multiple phantom address names is configured to generate a plurality of code variants for the code block, including to:
determine for each code variant the respective phantom security shift (δ) representing a relative memory location shift for a particular one of the respective phantom address name from a memory address computed based on the respective phantom address offset (Δ) for the particular one of the respective phantom address names; and
generate the plurality of code variants in the phantom address space, with the first instruction of each variant located in the phantom address space at a corresponding phantom address space location computed according to the respective phantom offset (Δ), and the respective determined phantom security shift δ;

and wherein the computing system further comprises a selector circuit to randomly select for execution one of the plurality of code variants.