Address Space Segmentation for Untrusted Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems face a conflict between ensuring security and stability, and achieving high performance, particularly for applications like video games, where type-safety restrictions can hinder speed and efficiency, leading to potential improper access to sensitive data structures.
Innovation Solution
Implementing a system where untrusted application programs execute in a lower-privilege mode with restricted access to type data structures, using a shared memory location with different permission sets for user and kernel mode components to prevent improper access, allowing untrusted applications to run without compromising system integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If type-safety restrictions are imposed to ensure security and stability, then system reliability is improved, but application execution speed and performance deteriorate
Solution Approach 1:
The patent divides the address space into multiple isolated spaces (e.g., user mode address space, kernel mode address space, and sandboxed address space). Each space has distinct permission sets, allowing untrusted applications to execute in isolated environments without compromising system-wide type safety and security. This segmentation enables performance optimization within sandboxed regions while maintaining reliability at the system level.
Solution Approach 2:
Different permission sets are assigned to different address spaces based on trust levels. Trusted components receive full permission sets including read/write/execute access, while untrusted applications receive restricted permission sets. This local differentiation allows high-performance execution for trusted code while maintaining security restrictions for untrusted code, resolving the contradiction between performance and reliability.
2Productivity
If untrusted applications are allowed to execute in high-privilege address space, then application performance is improved, but system security and stability deteriorate
Solution Approach 1:
The patent creates separate address spaces for trusted and untrusted applications, physically isolating them from each other. Untrusted applications execute in sandboxed address spaces that are isolated from the main system address space, preventing them from accessing or modifying critical system resources even though they can execute with elevated privileges within their own sandbox.
Solution Approach 2:
The patent introduces address space isolation as an intermediary mechanism between untrusted applications and the system kernel. This intermediary layer (the isolated address space boundary) allows untrusted applications to access system resources through controlled interfaces while blocking direct access to sensitive areas, thus maintaining security while enabling performance optimization.
3Ease of operation
If read/write access is granted to type data structures in user mode, then application ease of operation is improved, but risk of improper access to sensitive data increases
Solution Approach 1:
The patent segments access rights by creating separate address spaces with distinct permission sets. User mode applications receive read access to type data structures for ease of operation, but write access is restricted to prevent improper modifications. This segmentation of permissions allows operational ease while blocking harmful write operations.
Solution Approach 2:
Different permission sets are applied locally to different address spaces. The user mode address space has read permission for type data structures, enabling applications to read and operate with type information. The kernel mode address space maintains write permission for type data structures, preventing user mode applications from modifying them. This local permission differentiation resolves the contradiction between ease of operation and security.
Data Source
AI summary
Sensitive data structures, such as type data structures, can be used by untrusted application programs without necessarily exposing the sensitive data structures directly. For example, untrusted components, such as application programs that may or may not be type safe, can be allowed to operate in a lower-privilege mode. In addition, the application programs can be associated with an address space with limited permissions (e.g., read-only) to a shared memory heap. Requests by the untrusted components for sensitive data structures can then be handled by trusted components operating in a higher-privilege mode, which may have broader permissions to the shared memory heap. If the requests by the untrusted components are deemed to be valid, the results of the requests can be shared with the lower-privilege mode components through the shared memory heap.