Auxiliary Cache Metadata Verification for Secure Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face limitations in securing against cyber and memory-based attacks, with existing software and hardware protection measures being partial, resource-intensive, and requiring modifications to the processor architecture, while lacking effective runtime protection.
Innovation Solution
A computing device with a processor cache and an auxiliary cache for metadata access, along with a security verification unit that retrieves metadata for memory access requests, enabling fine-grained control flow integrity verification and code integrity protection without modifying the central processing unit core, and adaptable to various security levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing software protection measures (antivirus, canaries, virtual memory) are used, then partial protection against cyber attacks is provided, but memory and processing resources are heavily consumed
Solution Approach 1:
The patent replaces software-based protection mechanisms with hardware-based metadata caching and verification. The auxiliary cache and security verification unit operate at the hardware level, substituting the need for resource-intensive software antivirus programs, canaries, and dynamic tracking, thereby providing protection while reducing memory and processing resource consumption.
Solution Approach 2:
The patent implements preliminary action by pre-caching metadata in the auxiliary cache before it is needed for security verification. This allows the security verification unit to quickly retrieve metadata without consuming processing resources during runtime, providing proactive protection rather than reactive software-based security.
2Reliability
If hardware protection measures are implemented, then effective protection against memory-based attacks is provided, but processor architecture modifications are required
Solution Approach 1:
The patent segments the cache system into two independent parts: the processor cache for data/instructions and the auxiliary cache for metadata. This segmentation allows the security verification functionality to be added without modifying the core processor architecture, as the auxiliary cache operates independently and interfaces through existing cache control mechanisms.
Solution Approach 2:
The auxiliary cache acts as an intermediary between the processor cache and the security verification unit. It stores metadata that the security verification unit can retrieve to verify memory access requests, providing hardware-based protection without requiring direct modifications to the processor core architecture.
3Ease of operation
If tagged hardware architectures are used, then fine-grained memory access restrictions are implemented, but only physical memories can be tagged, not virtual memories
Solution Approach 1:
The auxiliary cache is designed to store metadata that can apply to both physical and virtual memory addresses. The security verification unit retrieves this metadata to enforce access restrictions regardless of whether the memory access is to physical or virtual memory, making the protection mechanism universal and adaptable to different memory management schemes.
4Reliability
If existing protection measures are deployed, then some security verification is provided, but runtime protection is lacking
Solution Approach 1:
The auxiliary cache continuously stores metadata and the security verification unit continuously verifies memory access requests in real-time. This continuous operation provides uninterrupted runtime protection, unlike batch-processing software solutions that only verify security periodically or after attacks occur.
Data Source
Figure 1
Figure 2
AI summary
Embodiments of the invention provide a computing device comprising one or more processors, each processor comprising one or more processing unit, said one or more processing units being configured to execute at least one program, each program comprising data and/or instructions, the computing device further comprising, for at least some of the processors, a processor cache associated with each processor, the processor cache being configured to access data and/or instructions comprised in the programs executed by the processor, the computing device comprising: - an auxiliary cache configured to access metadata associated with the data and/or instructions comprised in said programs; - a security verification unit configured to retrieve, from the auxiliary cache, at least a part of the metadata associated with data and/or instructions corresponding to a memory access request sent by a processor (11) to the processor cache (117).