Data Transform Accelerator Secure Memory Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data transform accelerators face challenges in securely processing sensitive data, as existing solutions often lack effective mechanisms to limit access and protect sensitive information during data transform operations, potentially leading to data breaches and unauthorized access.
Innovation Solution
A data transform accelerator is configured with a partitioned memory structure, where sensitive data is stored in a secure partition inaccessible to external processors, while public data is stored in an unsecure partition, with the internal processor managing access and encryption to ensure secure data processing and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data transform accelerators use a unified memory structure for all data, then ease of operation is improved, but security of sensitive data deteriorates
Solution Approach 1:
The memory structure is segmented into multiple partitions with different security levels. A first partition stores sensitive data with restricted access, while a second partition stores non-sensitive data with broader access. This segmentation allows the system to maintain ease of operation through unified memory management while improving security by isolating sensitive data in a dedicated partition that external processors cannot access.
2Speed
If sensitive data is stored in accessible memory for fast processing, then processing speed is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The memory is divided into secure and non-secure partitions, allowing sensitive data to be stored in fast accessible memory within the secure partition while preventing unauthorized access. The internal processor can access the secure partition for fast processing, but external processors are restricted from accessing it, thus maintaining both speed and security.
Solution Approach 2:
The internal processor acts as an intermediary between external processors and sensitive data stored in the secure partition. External processors can request data processing, but the internal processor mediates access to the secure partition, allowing fast processing of sensitive data while preventing direct unauthorized access from external processors.
3Device complexity
If all metadata is stored in one location for simplicity, then device complexity is reduced, but security control over sensitive information deteriorates
Solution Approach 1:
Metadata is segmented into different categories based on sensitivity. Public metadata is stored in the non-secure partition for easy access, while sensitive metadata is stored in the secure partition with restricted access. This segmentation maintains relatively low device complexity through unified memory management while improving security control by preventing external processors from accessing sensitive metadata.
Data Source
AI summary
A method includes initializing a virtual machine including a virtual machine memory disposed in memory of a data transform accelerator. The method also includes obtaining an address associated with a data transform command. The address may be disposed in a container located in a first partition of the virtual machine memory. The method also includes obtaining metadata associated with the data transform command. A first portion of the metadata may be public data and a second portion of the metadata may be sensitive data. The method further includes storing the public data in the first partition and the sensitive data in a second partition of the virtual machine memory. The method also includes configuring a data transform pipeline in the data transform accelerator based on the public data in the first partition and the sensitive data in the second partition.