US 11,995,177 B2
In-memory protection for controller security
Assaf Harel, Ramat Hasharon (IL); Amiram Dotan, Birmingham, MI (US); Tal Efraim Ben David, Hogla (IL); and David Barzilai, Hod Hasharon (IL)
Assigned to Karamba Security Ltd., Tel Aviv (IL)
Filed by Karamba Security Ltd., Hod Sharon (IL)
Filed on May 26, 2021, as Appl. No. 17/330,478.
Application 17/330,478 is a continuation of application No. 16/234,714, filed on Dec. 28, 2018, granted, now 11,023,574.
Application 16/234,714 is a continuation of application No. 15/997,167, filed on Jun. 4, 2018, granted, now 10,204,219, issued on Feb. 12, 2019.
Application 15/997,167 is a continuation in part of application No. 15/614,187, filed on Jun. 5, 2017, granted, now 10,878,103, issued on Dec. 29, 2020.
Prior Publication US 2021/0349991 A1, Nov. 11, 2021
Int. Cl. G06F 21/52 (2013.01); G06F 11/36 (2006.01); G06F 21/51 (2013.01); G06F 21/56 (2013.01); G06F 21/57 (2013.01); H04L 67/12 (2022.01)
CPC G06F 21/52 (2013.01) [G06F 11/3668 (2013.01); G06F 21/51 (2013.01); G06F 21/562 (2013.01); G06F 21/566 (2013.01); G06F 21/577 (2013.01); G06F 2221/033 (2013.01); H04L 67/12 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for hardening network-accessible controllers through integrating a customized security layer, the method comprising:
identifying computer-readable code configured to be run on a particular controller, wherein the computer-readable code is configured to be stored in a memory in a plurality of code portions, each code portion comprising one or more instructions to be performed by the particular controller;
identifying contextual information associated with the particular controller;
identifying a specific code portion from the plurality of code portions that is configured to be run on the particular controller;
selecting, from a plurality of available flow control integrity (IMV) schemes, an IMV scheme based on the identified contextual information, wherein the selected IMV scheme specifies instructions for at least one of:
function validation, or
memory address verification;
applying the selected IMV scheme to the identified specific code portion; and
hardening the particular controller by deploying the specific code portion to run on the particular controller according to the applied IMV scheme.