Cross-OS Kernel Resource Access via Address Space Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The dynamic integrity measurement module in a trusted execution environment (TEE) operating system has poor performance in providing integrity protection for a rich execution environment (REE) operating system due to limitations in accessing resources across different page tables, leading to inefficient real-time access and security concerns.
Innovation Solution
The method involves reserving high-order address space in the first operating system and reusing the register configuration of the kernel page table of the second operating system to enable direct access to the kernel space of the second operating system, improving performance and security by configuring the kernel and user page tables with appropriate permissions and protections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the TEE OS uses traditional page table isolation methods to access REE OS resources, then security isolation is maintained, but access performance deteriorates due to page table copying and synchronization overhead
Solution Approach 1:
The patent segments the address space by reserving high-order address space in the TEE OS for direct REE OS resource access, while maintaining separate low-order address space for TEE OS internal operations. This segmentation allows simultaneous security isolation and high-performance access by directing different types of accesses to appropriate address spaces.
Solution Approach 2:
The patent introduces a register configuration mechanism as an intermediary between the TEE OS and REE OS page tables. By configuring registers to map high-order address space to REE OS kernel space, the system enables direct access without requiring traditional page table copying, thus maintaining security while improving performance.
2Productivity
If the TEE OS directly accesses REE OS resources without page table isolation, then access performance improves, but security isolation deteriorates
Solution Approach 1:
The patent applies local quality by enabling direct address space mapping only in the reserved high-order address space of the TEE OS, while maintaining traditional page table isolation in the low-order address space. This localized approach allows performance optimization without compromising overall security isolation.
3Reliability
If the system implements traditional page table copying for cross-OS resource access, then security is maintained, but system complexity and overhead increase
Solution Approach 1:
The patent extracts the page table copying operation from the resource access path by establishing a direct address space mapping mechanism through register configuration. This extraction eliminates the complexity of page table synchronization while maintaining security through the reserved address space architecture.
Data Source
AI summary
A method includes configuring a memory for storing a kernel page table and a user page table to low-order address space, and reserving high-order address space, obtaining register configuration information of a kernel page table of a second operating system from the second operating system, and configuring a register of the high-order address space of a first operating system based on the register configuration information of the kernel page table of the second operating system such that the high-order address space is enabled to directly access a kernel resource of the second operating system.