Contingent Memory Access Disable Flag for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems supporting contingent memory access program instructions face a security risk as malicious actors can scan memory address spaces without triggering exceptions, allowing them to determine configuration details using timing analysis.
Innovation Solution
The implementation of memory access circuitry and permission circuitry that differentiates between contingent and non-contingent memory access operations, with the permission circuitry being selectively disabled for contingent operations via a flag, preventing unauthorized access and masking configuration information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If contingent memory access program instructions are supported to enable software-managed speculation, then program execution flexibility and performance are improved, but system security deteriorates due to the ability to scan memory address space without triggering exceptions
Solution Approach 1:
The patent applies local quality by differentiating permission checking behavior between contingent and non-contingent memory access instructions. The memory permission circuitry is configured to selectively enable or disable permission checking based on the instruction type, allowing flexible execution for contingent accesses while maintaining security through permission verification for non-contingent accesses.
Solution Approach 2:
The patent implements dynamics by introducing a configurable flag that dynamically controls the permission checking behavior of the memory permission circuitry. This flag can be set to enable or disable permission checking for contingent memory access instructions, allowing the system to adapt its security posture based on execution context and requirements.
2Object-affected harmful factors
If permission checking is enabled for all memory accesses, then system security is improved, but program execution performance deteriorates due to exception triggers on speculative accesses
Solution Approach 1:
The patent applies local quality by implementing differentiated permission checking: contingent memory access instructions (used for speculative execution) have permission checking disabled to avoid exception triggers and performance penalties, while non-contingent instructions maintain permission checking for security. This localized approach to permission verification optimizes both security and performance.
Solution Approach 2:
The patent implements dynamics through a control flag that dynamically adjusts the permission checking behavior of the memory permission circuitry. When the flag is set, permission checking is disabled for contingent accesses to improve performance; when cleared, permission checking is enabled to ensure security. This dynamic control allows the system to adapt to different execution phases.
Data Source
AI summary
A data processing apparatus and method serve to manage access permission checking in respect of contingent memory access operations (the access permission failure of which does not alter program flow) in dependence of a contingent-access permission checking disable flag. If the contingent access disable flag has a first value, then this disables memory permission circuitry e.g. a walk state machine 22, from performing a check as to whether or not the memory access circuitry is permitted to perform a requested memory access. Non-contingent memory accesses are able to utilise the memory permission circuitry irrespective of the value of the contingent-access permission checking disable flag.