Patent ID: 11947663
Assignee: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. Non-transitory computer readable media comprising computer instructions executable on a processor-based device to:
generate for a code block of a process executing on a processor-based device a code block replica an address in a virtual address space of the processor-based device, wherein the code block of the process is stored in a particular segment of a physical address space of the processor-based device;
generate multiple phantom address names that all map to the code block replica in the virtual address space, each of the multiple phantom address names having a phantom space address that is based on a respective phantom offset (Δ) and a respective phantom security shift (δ), wherein random selection of any of the generated multiple phantom address names causes runtime-determined program control flow that mitigates code-reuse attacks requiring predictable runtime program control flow; and
for each group of one or more instructions, randomly selecting during runtime, when the code block of the process is to be processed, one of the multiple phantom address names based on which the program counter value is computed, wherein the randomly selected one of the multiple phantom address names is mapped into the code block replica in the virtual address space, with the code block replica to which the randomly selected one of the multiple phantom address names is mapped being subsequently translated to a physical address of the code block of the process;
wherein the computer instructions to generate the multiple phantom address names comprise one or more instructions to generate a plurality of code variants for the code block, including to:
determine for each code variant the respective phantom security shift (δ) representing a relative memory location shift for a particular one of the respective phantom address name from a memory address computed based on the respective phantom address offset (Δ) for the particular one of the respective phantom address names; and
generate the plurality of code variants in the phantom address space, with the first instruction of each variant located in the phantom address space at a corresponding phantom address space location computed according to the respective phantom offset (Δ), and the respective determined phantom security shift δ;

and wherein the computer instructions to randomly select one of the multiple phantom address names comprise additional one or more instructions to randomly select for execution one of the plurality of code variants.