Address Mask Table for TEE Context Switch Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In an OS environment where a protection-target program is dynamically loaded and mapped, entry point masking cannot be used to prevent physical attacks on a Trusted Execution Environment (TEE) due to dynamic changes in isolation settings.
Innovation Solution
A program processing device that includes setting data specifying physical and logical addresses, a call wrapper function for context switching, an address mask table generation section, a countermeasure application section to attach the call wrapper to the program, and an execution section to look up the address mask table and unmask jump addresses based on determined isolation settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If entry point masking is used to prevent physical attacks on TEE, then security against fault attacks is improved, but the method cannot be applied in OS environments with dynamic program loading and mapping
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing masked jump addresses in a table structure before program execution. The address mask table generation section creates entries that map isolated addresses to real addresses in advance, allowing the execution section to quickly retrieve and apply the correct masked addresses during context switches without dynamic calculation.
Solution Approach 2:
The patent introduces an address mask table as an intermediary mechanism between the isolation setting and the actual jump address. This table serves as a mediator that translates isolated addresses (which change with dynamic OS mapping) to real addresses (which remain constant for security), enabling entry point masking to work in dynamic OS environments.
2Adaptability or versatility
If isolation setting changes dynamically with each execution in OS environment, then program flexibility and dynamic loading capability are improved, but entry point masking becomes ineffective
Solution Approach 1:
The system performs preliminary action by pre-computing the relationship between isolated addresses and real addresses for all possible execution contexts and storing them in the address mask table. This allows the execution section to retrieve the correct masked address instantly during context switches, maintaining masking effectiveness despite dynamic isolation changes.
Solution Approach 2:
The patent uses copying by creating a table of pre-computed address mappings. Instead of calculating masked addresses in real-time for each dynamic execution context, the system copies pre-computed address relationships into the address mask table, enabling fast retrieval and application during execution while adapting to dynamic OS conditions.
3Productivity
If jump address is acquired without unmasking in dynamic execution, then execution speed is improved, but unauthorized memory access can occur
Solution Approach 1:
The patent applies preliminary action by pre-storing masked jump addresses in the address mask table during program setup. During execution, the system simply retrieves the pre-computed masked address from the table rather than calculating it in real-time, maintaining high execution speed while ensuring security through the pre-established address mapping.
Solution Approach 2:
The address mask table serves as an intermediary that bridges the gap between speed and security. It provides pre-computed masked addresses that can be retrieved instantly during execution, eliminating the need for real-time calculation while ensuring that only authorized memory access is permitted through the established address mapping.
Data Source
AI summary
A program processing device includes an address mask table generation section, a countermeasure application section, and an execution section. The address mask table generation section generates an address mask table based on setting data. The countermeasure application section attaches a call wrapper to a program, identifies a transition process of performing context switch from the program, and replaces the transition process with a process of performing a jump by specifying a physical address where the call wrapper is to be deployed. The execution section looks up the address mask table in executing a countermeasure-applied program, allocates a memory and assigns a physical address. Instead of acquiring a jump address with no change in the transition process, the execution section makes a change so as to use a jump address obtained by unmasking the jump address acquired by looking up the address mask table, based on determined isolation setting.