Cache Coherency for Secure Data Access via Status Fields
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems face challenges in managing secure and non-secure data caches, particularly in ensuring secure data access and maintaining cache coherency across multiple domains, which becomes complex with larger operating systems and requires hardware-level security mechanisms.
Innovation Solution
A data processing apparatus with a secure and non-secure domain, featuring a cache with status fields indicating security levels and a bus fabric that provides security data for access requests, allowing secure and non-secure data access while maintaining cache coherency through hardware arbitration, and utilizing verification flags for secure data access confirmation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a cache is provided to store copies of data items for faster access, then data access speed is improved, but security management complexity increases when both secure and non-secure data are stored
Solution Approach 1:
The cache is segmented into secure and non-secure portions, with each cache line tagged with security attributes. This allows the cache to maintain both secure and non-secure data simultaneously while enabling security-aware access control, thus improving data access speed without compromising security management
Solution Approach 2:
A security management mechanism acts as an intermediary between the cache and processing elements. This intermediary tracks security attributes of cache lines and enforces access policies, simplifying security management while maintaining fast cache access for authorized operations
2Productivity
If the cache size is increased to store more data items, then data access efficiency is improved, but cache operation speed decreases
Solution Approach 1:
Different security domains are assigned to different cache lines based on their access requirements. Frequently accessed secure data can be placed in optimized cache lines with appropriate security attributes, while maintaining overall cache efficiency. This local differentiation allows larger cache capacity without uniformly degrading operation speed
3Adaptability or versatility
If software-based cache coherency management is used for secure and non-secure domains, then flexibility is improved, but system performance decreases
Solution Approach 1:
The cache system performs self-service for security management by automatically tracking and enforcing security attributes of cache lines. The security management mechanism operates autonomously to maintain coherency between secure and non-secure domains, providing both flexibility and high performance without software intervention overhead
4Reliability
If hardware-level security mechanisms are implemented in the cache, then security is improved, but device complexity increases
Solution Approach 1:
Security management functionality is merged with the existing cache structure by integrating security attribute tracking and enforcement into the cache control logic. This unified approach provides strong hardware-level security while minimizing additional complexity through shared resources and coordinated operation
Data Source
AI summary
A cache in a data processing apparatus has a status field associated with each entry in the cache to store a security value indicative of whether the data stored in that entry are secure data, non-secure data or aliased data. Secure data are only accessible in response to a secure data access request, non-secure data are only accessible in response to a non-secure data access request and aliased data are accessible in response to either a secure or a non-secure data access request. The data processing apparatus also has bus fabric which provides security data in response to a bus access request, the security data being indicative of whether the bus access request is to a storage location designated as secure, non-secure or aliased.