Intel Corporation
System, method and apparatus for automatic program compartmentalization

Abstract:

The disclosed embodiments relate to system, method and apparatus to compartmentalize information in a program so as to protect against malware. In one embodiment, the disclosed provides a compiler that is enhanced to automatically define multiple compartments within a program based on the data sets that they access. The disclosed embodiments may be implemented at a compiler and certain embodiments may be referred to as compartmentalizing compiler. For each data set, an exemplary compartmentalizing compiler separates program elements that need direct access to the data set from those that do not and it defines a boundary around the data set and the program elements that need to access it. In certain embodiments, other portions of the program may still need to invoke the compartment. Thus, the disclosure also generates interface routines to copy data back and forth through the compartment boundary.