Methods and systems for ensuring program code flow integrity
In one embodiment a device is described, the device including a memory operative to store an program, a storage operative to store a reference check value for at least one operation in the program, a processor operative to execute the program, including, determining a run-time check value upon execution of the at least one operation in the program, comparing the stored reference check value with the run-time check value, storing the run-time check value as a pre-branch run-time check value prior to entering a conditional branch of the program when the compared stored reference check value and the run-time check value are equal values, resetting the run-time check value of the executing program to the pre-branch run-time check value upon exiting the conditional branch of the program, wherein the reference check value, the run-time check value, and the pre-branch run-time check value are determined as a result of a single function. Related apparatus, methods and systems are also described.
1. A device comprising:
a memory operative to store an application program;
a storage operative to store a reference check value for at least one operation in the application program;
a processor operative to:
execute the application program;
determine a run-time check value upon execution of the at least one operation in the application program;
compare the reference check value with the run-time check value;
store the run-time check value as a pre-branch run-time check value prior to executing operations within a conditional branch of the application program in response to determining that the reference check value and the run-time check value are equal values; and
reset the run-time check value of the application program to the pre-branch run-time check value, stored prior to entering the conditional branch, upon exiting the conditional branch of the application program,
wherein the reference check value, the run-time check value, and the pre-branch run-time check value are determined as a result of a single function.
2. The device according to claim 1 , wherein a processor external to the device determines the reference check value.
3. The device according to claim 1 , wherein the application program is stored in the memory as object code.
4. The device according to claim 1 , wherein the reference check value, the run-time check value, and the pre-branch run-time check value are determined as a result of an iterative update function.
5. The device according to claim 4 , wherein the iterative update function comprises an 8-bit iterative update function.
6. The device according to claim 4 , wherein the iterative update function comprises a 16-bit iterative update function.
7. The device according to claim 4 , wherein the iterative update function comprises a cyclic redundancy check (CRC).
8. The device according to claim 4 , wherein the iterative update function comprises a checksum function.
9. The device according to claim 4 , wherein the iterative update function comprises a non-CRC, non-checksum hash function.
10. The device according to claim 4 , wherein the iterative update function comprises a proprietary function.
11. A method comprising:
storing an application program in a memory;
storing in a storage a reference check value for at least one operation in the application program;
executing the application program on a processor, the executing comprising:
determining a run-time check value upon execution of the at least one operation in the application program;
comparing the reference check value with the run-time check value;
storing the run-time check value as a pre-branch run-time check value prior to executing operations within a conditional branch of the application program in response to determining that the reference check value and the run-time check value are equal values;
resetting the run-time check value of the application program to the pre-branch run-time check value, stored prior to entering the conditional branch, upon exiting the conditional branch of the application program,
wherein the reference check value, the run-time check value, and the pre-branch run-time check value are determined as a result of a single function.
12. The method according to claim 11 , wherein an external processor determines the reference check value.
13. The method according to claim 11 , wherein the application program is stored in the memory as object code.
14. The method according to claim 11 , wherein the reference check value, the run-time check value, and the pre-branch run-time check value are determined as a result of an iterative update function.
15. The method according to claim 14 , wherein the iterative update function comprises an 8-bit iterative update function.
16. The method according to claim 14 , wherein the iterative update function comprises an 16-bit iterative update function.
17. The method according to claim 14 , wherein the iterative update function comprises a cyclic redundancy check (CRC).
18. The method according to claim 14 , wherein the iterative update function comprises a checksum function.
19. The method according to claim 14 , wherein the iterative update function comprises a non-CRC, non-checksum hash function.
20. The method according to claim 14 , wherein the iterative update function comprises a proprietary function.