Access Control Circuitry for Off-Chip Accelerator Memory Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control systems in data processing apparatuses lack effective mechanisms to prevent unauthorized access by off-chip accelerators or co-processors, such as FPGAs, which can be configured maliciously or incorrectly, leading to potential data corruption or access to unintended physical memory addresses.
Innovation Solution
The implementation of an access control circuitry that detects memory address translations between virtual and physical memory addresses, stores valid translations, and compares incoming physical memory addresses against a stored set to permit or inhibit access, providing a safeguard against unauthorized access without requiring changes to the operating system or hypervisor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If off-chip accelerators or co-processors are used to perform specific functions more efficiently, then processing performance is improved, but security against unauthorized access to physical memory addresses deteriorates
Solution Approach 1:
An access control circuit is introduced as an intermediary component between the off-chip accelerator and the physical memory address space. This circuit intercepts physical address accesses from the accelerator, translates them to virtual address space, and validates them against authorized virtual addresses, thereby preventing unauthorized physical memory access while allowing legitimate accelerated processing operations
Solution Approach 2:
The access control mechanism segments the address translation and validation process into distinct stages: physical address reception, translation to virtual address, comparison with authorized virtual addresses, and conditional permission granting. This segmentation allows the system to maintain high processing performance while implementing comprehensive security checks
2Reliability
If address translation and access control mechanisms are implemented, then security is improved, but device complexity increases
Solution Approach 1:
The access control circuit is designed to perform multiple functions: it translates physical addresses to virtual addresses, validates virtual address authorization, and controls access permission. By consolidating these functions into a single multi-functional circuit, the design achieves comprehensive security without proportionally increasing overall system complexity
Solution Approach 2:
The access control circuit autonomously performs address translation and validation operations without requiring external intervention or complex control logic from the host system. The circuit self-manages the security validation process, reducing the burden on other system components and simplifying overall system architecture
Data Source
AI summary
Access control circuitry comprises: a detector to detect a memory address translation between a virtual memory address in a virtual memory address space and a physical memory address in a physical memory address space, provided in response to a translation request by further circuitry; an address translation memory, to store data representing a set of physical memory addresses previously provided to the further circuitry in response to translation requests by the further circuitry; an interface to receive a physical memory address from the further circuitry for a memory access by the further circuitry; a comparator to compare a physical memory address received from the further circuitry with the set of physical addresses stored by the address translation memory, and to permit access, by the further circuitry, to a physical address included in the set of one or more physical memory addresses.