Granted Patent B2

US 12,373,314 · App. 18/472,857 · Granted Jul 29, 2025

Inventors: Andrew Sutherland (Portland, OR); Jonathan B. Rosenberg (Wayland, MA); Gregory T. Sullivan (Rockport, MA)

Assignee: Dover Microsystems, Inc.

G06F11/1479G06F9/3885G06F9/4498G06F21/51G06F21/52

Abstract

Claims (74)

1. A system comprising enforcement hardware configured to:

execute, at run time, a state machine in parallel with application code, comprising:

maintaining metadata that corresponds to one or more state variables of the state machine;

matching instructions in the application code to transitions in the state machine; and

in response to determining that an instruction in the application code does not match any transition from a current state of the state machine, causing an error handling routine to be executed, wherein:

the state machine represents a safety property to be enforced while the application code is executed;

maintaining metadata comprises associating metadata with data manipulated by the instruction in the application code; and

the enforcement hardware is configured to attempt to match the instruction in the application code to a transition in the state machine based on the metadata associated with the data manipulated by the instruction.

2. The system of claim 1 , wherein:

the instruction comprises a first instruction; and

executing the state machine in parallel with the application code further comprises:

in response to determining that a second instruction in the application code matches a transition from a current state of the state machine, performing a metadata update according to the matched transition.

3. The system of claim 1 , wherein causing an error handling routine to be executed comprises:

generating an alert; and/or

preventing the instruction from being executed.

4. The system of claim 1 , wherein:

the enforcement hardware comprises policy enforcement hardware configured to check run time behavior of the application code against at least one policy; and

the at least one policy comprises a security policy and/or a privacy policy.

5. The system of claim 4 , wherein:

the at least one policy comprises the security policy; and

the security policy comprises an information flow integrity policy.

6. The system of claim 1 , wherein:

maintaining metadata comprises associating metadata with the instruction in the application code; and

the enforcement hardware is configured to attempt to match the instruction in the application code to a transition in the state machine based on the metadata associated with the instruction.

7. A method implemented by a system comprising enforcement hardware, the method comprising an act of:

executing, at run time, a state machine in parallel with application code, comprising:

maintaining metadata that corresponds to one or more state variables of the state machine;

matching instructions in the application code to transitions in the state machine; and

in response to determining that an instruction in the application code does not match any transition from a current state of the state machine, causing an error handling routine to be executed, wherein:

the state machine represents a safety property to be enforced while the application code is executed;

maintaining metadata comprises associating metadata with data manipulated by the instruction in the application code; and

matching instructions in the application code to transitions in the state machine comprises attempting to match the instruction in the application code to a transition in the state machine based on the metadata associated with the data manipulated by the instruction.

8. The method of claim 7 , wherein:

the instruction comprises a first instruction; and

executing the state machine in parallel with the application code further comprises:

in response to determining that a second instruction in the application code matches a transition from a current state of the state machine, performing a metadata update according to the matched transition.

9. The method of claim 7 , wherein causing an error handling routine to be executed comprises:

generating an alert; and/or

preventing the instruction from being executed.

10. The method of claim 7 , wherein:

the enforcement hardware comprises policy enforcement hardware configured to check run time behavior of the application code against at least one policy; and

the at least one policy comprises a security policy and/or a privacy policy.

11. The method of claim 10 , wherein:

the at least one policy comprises the security policy; and

the security policy comprises an information flow integrity policy.

12. The method of claim 7 , wherein:

maintaining metadata comprises associating metadata with the instruction in the application code; and

matching instructions in the application code to transitions in the state machine comprises attempting to match the instruction in the application code to a transition in the state machine based on the metadata associated with the instruction.

13. At least one non-transitory computer-readable medium having encoded thereon instructions configured to program at least one processor to perform a method comprising an act of:

executing, at run time, a state machine in parallel with application code, comprising:

maintaining metadata that corresponds to one or more state variables of the state machine;

matching instructions in the application code to transitions in the state machine; and

in response to determining that an instruction in the application code does not match any transition from a current state of the state machine, causing an error handling routine to be executed, wherein:

the state machine represents a safety property to be enforced while the application code is executed;

maintaining metadata comprises associating metadata with data manipulated by the instruction in the application code; and

matching instructions in the application code to transitions in the state machine comprises attempting to match the instruction in the application code to a transition in the state machine based on the metadata associated with the data manipulated by the instruction.

14. The at least one non-transitory computer-readable medium of claim 13 , wherein:

the instruction comprises a first instruction; and

executing the state machine in parallel with the application code further comprises:

in response to determining that a second instruction in the application code matches a transition from a current state of the state machine, performing a metadata update according to the matched transition.

15. The at least one non-transitory computer-readable medium of claim 13 , wherein causing an error handling routine to be executed comprises:

generating an alert; and/or

preventing the instruction from being executed.

16. The at least one non-transitory computer-readable medium of claim 15 , wherein:

the at least one processor comprises at least one field-programmable gate array (FPGA).

17. The at least one non-transitory computer-readable medium of claim 13 , wherein:

the instructions encoded on the at least one non-transitory computer-readable medium are configured to program the at least one processor to check run time behavior of the application code against at least one policy; and

the at least one policy comprises a security policy and/or a privacy policy.

18. The at least one non-transitory computer-readable medium of claim 17 , wherein:

the at least one policy comprises the security policy; and

the security policy comprises an information flow integrity policy.

19. The at least one non-transitory computer-readable medium of claim 13 , wherein:

maintaining metadata comprises associating metadata with the instruction in the application code; and

matching instructions in the application code to transitions in the state machine comprises attempting to match the instruction in the application code to a transition in the state machine based on the metadata associated with the instruction.

Assignments (1)

Continuity (3)

References Cited (400)