Cache Security Logic for Data Access Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face vulnerabilities where secure data can be inadvertently accessed using non-secure data transactions, potentially compromising the integrity of secure data stored in caches, even with strict security safeguards in place.
Innovation Solution
A data processing apparatus with cache interface logic that includes security determination logic to verify the association of data access requests with secure or non-secure data regions using a data region allocation table, preventing non-secure access to secure data by ensuring that data access requests are validated before completion, and maintaining security state indications for each data value.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If security checks are performed only at main memory access, then data access speed is improved, but security integrity deteriorates as secure data can be accessed via non-secure transactions through cache
Solution Approach 1:
The patent applies preliminary action by performing security validation at the time of cache population rather than at the time of cache access. The data region allocation table is updated with security attributes when data is first written to cache, so that subsequent non-secure accesses can be quickly blocked without repeated security checks, thus maintaining both speed and security integrity
Solution Approach 2:
The patent introduces a data region allocation table as an intermediary structure that stores security attribute information for cached data. This table acts as a mediator between the cache and security management, allowing the system to verify security attributes of cached data without accessing main memory, thus resolving the contradiction between fast access and security validation
2Reliability
If security validation is performed for every cache access, then security integrity is improved, but data access speed deteriorates due to additional validation overhead
Solution Approach 1:
The patent applies local quality by differentiating security validation based on the specific access scenario. For non-secure accesses to cached data, the system performs local validation using the data region allocation table which is much faster than full security checks. This selective validation approach maintains security integrity while minimizing speed impact
3Adaptability or versatility
If the system allows processor mode switching, then system versatility is improved, but security risks increase as mode switching may bypass security safeguards
Solution Approach 1:
The patent implements feedback by continuously monitoring and validating the security attributes of data in the data region allocation table, even after processor mode switching. The system provides feedback to block any non-secure access attempts to secure data regions, ensuring that mode switching does not create security vulnerabilities while maintaining system versatility
Data Source
AI summary
A data processing apparatus is provided, which is operable to access data values associated with a respective address values. The data processing apparatus has: a processor; a main memory having a secure data values region; a cache; and cache interface logic having data transaction logic and security determination logic. The data transaction logic receives from the processor a data access request for accessing data in cache. The data access request has an associated address value and a security attribute. If the security attribute indicates that the request is a non-secure data-access request, the security determination logic determines, via a data region allocation table, whether the request is associated with the secure data values region of main memory and the non-secure data access request is allowed to complete if it is not associated with the secure data region.