Intra-Level Privilege Separation for ARM System Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing trend of mobile systems with system software poses a significant risk of personal information theft due to attacks on system software, necessitating a solution to protect sensitive computations even when system software is corrupted.
Innovation Solution
An intra-level privilege separation system for ARM processors divides system software into an inner domain for sensitive computations and an outer domain for non-sensitive computations, using domain isolation units and domain switching mechanisms to manage memory access and privilege levels, ensuring secure operation even if the outer domain is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system software is divided into inner and outer domains with different privilege levels, then system security is improved by isolating sensitive resources, but device complexity increases due to domain isolation mechanisms
Solution Approach 1:
The system software is segmented into two distinct domains: an inner domain with higher privilege level for sensitive computations and an outer domain with lower privilege level for non-sensitive computations. This segmentation isolates critical resources, ensuring that even if the outer domain is compromised, the inner domain remains protected. The domain isolation unit enforces these boundaries through hardware-supported privilege levels.
Solution Approach 2:
A domain isolation unit is introduced as an intermediary component that mediates access between the inner and outer domains. This unit controls memory access and privilege transitions, allowing the system to maintain security boundaries while enabling necessary communication and data sharing between domains through controlled interfaces.
2Reliability
If domain switching mechanism is implemented to control memory access, then unauthorized access is prevented, but processing speed decreases due to domain switching overhead
Solution Approach 1:
The domain switching mechanism dynamically adjusts privilege levels and memory access permissions based on the current execution context. The system can switch between inner and outer domains as needed, with the domain isolation unit dynamically modifying memory management registers (such as TTBR0, TTBR1, TCR) to enforce appropriate access controls for each domain state.
Solution Approach 2:
The system changes key parameters during domain switching, including translation table base registers (TTBR0, TTBR1) and translation control register (TCR) settings like T0SZ values. These parameter changes enable the same hardware to enforce different memory protection policies for inner and outer domains without requiring separate physical memory systems.
3Reliability
If memory regions are dynamically set inside or outside valid virtual address range, then isolation effectiveness is improved, but manufacturing precision requirements increase for register configuration
Solution Approach 1:
The domain isolation unit pre-configures memory regions and their validity status before domain switching occurs. By establishing the valid virtual address range boundaries in advance through register setup (TTBR, TCR), the system ensures that when domain switching happens, the memory isolation is already in place, reducing the precision requirements during actual switching operations.
Data Source
AI summary
Embodiments relate to an intra-level privilege separation method for managing system software on an ARM processor, including dividing the system software into an inner domain and an outer domain having different privilege levels, determining whether to permit the access to a memory region of the inner domain based on the type of domain that is currently in control among the inner domain and the outer domain, setting the memory region of the inner domain outside of valid virtual address range when the outer domain is in control, and setting memory regions of the inner domain and the outer domain inside of valid virtual address range when the inner domain is in control.