University of Pennsylvania

The Charles Stark Draper Laboratory, Inc.

Bae Systems Information and Electronic Systems Integration Inc.

The National Institute for Research in Data Processing and Automation

Udit Dhawan

Andre DeHon

Silviu S Chiricescu

André M DeHon

Andre′ DeHon

Andre' DeHon

Nicholas Edward Roessler

Catalin Hritcu

Techniques are described for metadata processing that can be used to encode an arbitrary number of security policies for code running on a processor. Metadata may be added to every word in the system and a metadata processing unit may be used that works in parallel with data flow to enforce an arbitrary set of policies. In one aspect, the metadata may be characterized as unbounded and software programmable to be applicable to a wide range of metadata processing policies. Techniques and policies have a wide range of uses including, for example, safety, security, and synchronization. Additionally, described are aspects and techniques in connection with metadata processing in an embodiment based on the RISC-V architecture.

Techniques for metadata processing

Methods, systems, and computer readable media for using variable metadata tags. A method occurs at a metadata processing system for enforcing security policies in a processor architecture. The method comprises: receiving, at the metadata processing system, a tag associated with a word in memory, wherein the tag indicates a memory location containing metadata associated with the word and wherein the tag length is at least in part determined using tag usage frequency; obtaining the metadata from the memory location, and determining, using the metadata, whether the word or a related instruction violates a security policy.

Methods, systems, and computer readable media for adaptive metadata architecture

A method includes receiving, for metadata processing, a current instruction with a associated metadata tags. The metadata processing is performed in a metadata processing domain isolated from a code execution domain including the current instruction. Each respective associated metadata tag representing a respective policy of the composite policy. The associated metadata tags further including pointers to tags of a component policy of the composite policy. For each respective metadata tag, the method includes determining, in the metadata processing domain and in accordance with the metadata tag and the current instruction, whether a rule exists in a rule cache for the current instruction. The rule cache including rules on metadata used by said metadata processing to define allowed instructions. The determination of whether a rule exists resulting in a respective output. The method further includes generating a composite result tag by combining the respective outputs into a single metadata tag representing the composite policy including each respective policy.

Processing metadata, policies, and composite tags

A system and method for metadata processing that can be used to encode an arbitrary number of security policies for code running on a stored-program processor. This disclosure adds metadata to every word in the system and adds a metadata processing unit that works in parallel with data flow to enforce an arbitrary set of policies, such that metadata is unbounded and software programmable to be applicable to a wide range of metadata processing policies. This instant disclosure is applicable to a wide range of uses including safety, security, and synchronization.

Programmable unit for metadata processing

Growing community of inventors

New Delhi, India

Udit Dhawan