Function-Level Isolation via Deprivileged Mode and Capability Sets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for function-level isolation in shared computing resources, such as Cloud computing and Function as a Service (FaaS), face challenges with high latency, memory overhead, and inefficiencies due to the need for secure isolation, which limits their applicability in low-latency applications like network packet processing and increases the risk of intellectual property leakage.
Innovation Solution
The implementation of a deprivileged operation mode that allows for function-level isolation through the use of a modified instruction set, including CALL_DEPRIVILEGED and RET_DEPRIVILEGED, which restricts system calls and exceptions, and employs page protection keys and segment registers to enforce access controls, enabling efficient function-level isolation without the need for process or virtual machine level isolation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If process or virtual machine level isolation is used to provide secure isolation, then security and privacy are improved, but latency increases and memory overhead increases
Solution Approach 1:
The patent segments isolation at the function level rather than using coarser process or virtual machine boundaries. Each function receives a capability set that defines its access permissions, allowing fine-grained security enforcement without the overhead of full process isolation. This segmentation enables security to be applied only where needed, reducing unnecessary latency and memory consumption.
Solution Approach 2:
The capability-based security model applies security controls locally to each function's execution context rather than globally across entire processes or virtual machines. By assigning specific capabilities to individual functions, the system enforces security only for the specific operations each function needs to perform, avoiding the blanket isolation overhead of process-level or VM-level approaches.
2Reliability
If process or virtual machine level isolation is used to provide secure isolation, then security and privacy are improved, but memory overhead increases
Solution Approach 1:
The patent segments memory resources and access permissions at the function level through capability sets. Each function is allocated only the memory resources and access permissions it specifically needs, rather than reserving large memory spaces for entire processes or virtual machines. This function-level segmentation dramatically reduces the total memory overhead required for isolation.
Solution Approach 2:
The system changes the parameters of isolation from fixed process or virtual machine boundaries to dynamic capability sets that can be adjusted per function. This allows memory allocation to be optimized for each function's actual needs rather than being constrained by larger, less flexible isolation boundaries, reducing overall memory consumption.
3Loss of time
If function-level isolation is implemented with capability-based security, then latency is reduced and memory usage is reduced, but system complexity increases
Solution Approach 1:
The patent introduces capability sets as an intermediary layer between functions and system resources. These capability sets act as a standardized interface that simplifies the enforcement of security policies at function level. By mediating access through capabilities rather than implementing complex function-specific isolation mechanisms, the system achieves low latency without proportionally increasing complexity.
4Quantity of substance
If function-level isolation is implemented with capability-based security, then memory usage is reduced, but system complexity increases
Solution Approach 1:
The capability-based security system enables functions to self-manage their access permissions through predefined capability sets. Rather than requiring complex external management of function-level isolation resources, each function operates with the capabilities it needs already configured, reducing the operational complexity of managing memory-efficient isolation at scale.
Data Source
AI summary
Embodiments are directed toward techniques to detect a first function associated with an address space initiating a call instruction to a second function in the address space, the first function to call the second function in a deprivileged mode of operation, and define accessible address ranges for segments of the address space for the second function, each segment to a have a different address range in the address space where the second function is permitted to access in the deprivileged mode of operation, Embodiments include switching to the stack associated with the second address space and the second function, and initiating execution of the second function in the deprivileged mode of operation.