Domain Access Control via Entry Exit Call Gateways

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems for protecting devices from unauthorized access, such as IoT devices, face challenges due to vulnerabilities in modules with varying security levels, where the weakest module can compromise the entire device, and known methods like function tables and hash tables suffer from performance issues and unpredictability.

Innovation Solution

Implementing entry and exit call gateways with transition instructions and access parameters stored in trusted memory, which enforce specific access points and privileges, ensuring secure transitions between domains and preventing unauthorized access by verifying the compatibility and authenticity of these gateways.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If function tables or hash tables are used to protect domains, then access control is achieved, but performance deteriorates and becomes unpredictable

Engineering Contradiction:

Improveaccess control securityVSAvoidaccess verification performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent replaces traditional mechanical lookup tables (function tables, hash tables) with a context switch mechanism that uses hardware-supported domain transitions. Instead of searching through tables to verify access, the system uses predefined transition instructions that directly switch between secure domains, achieving both security and high performance without the unpredictability of table-based verification.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the parameter of access verification from table-based search operations to context switch operations with predefined transition instructions. By changing how access control is implemented (from software table lookup to hardware context switching), the system achieves more predictable and faster performance while maintaining security.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If modules with varying security levels are provided, then functionality is improved, but the weakest module can compromise the entire device

Engineering Contradiction:

Improvemodule functionalityVSAvoidoverall device security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the device into multiple secure domains with different security levels, where each domain is isolated from others. This segmentation allows modules with varying functionality and security requirements to coexist without compromising each other, as each domain operates independently with its own access control mechanisms.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism (the monitor or gateway) that mediates between domains with different security levels. This intermediary handles the transitions and access requests between domains, ensuring that the weakest module cannot directly compromise other domains while still allowing necessary functionality to operate across security boundaries.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If access control mechanisms are implemented, then unauthorized access is prevented, but device complexity increases

Engineering Contradiction:

Improveunauthorized access preventionVSAvoidaccess control structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements a universal access control mechanism that handles multiple security scenarios through a single framework. The context switch mechanism with transition instructions serves multiple purposes: it provides access control, manages domain transitions, and enforces security policies simultaneously, reducing the need for separate complex access control structures.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10757100B2Methods and apparatus for protecting domains of a device from unauthorized accesses

Publication Date: 2020.08.25 ARM IP

AI summary

A machine implemented method for protecting a target domain and a source domain from unauthorized accesses. The method comprising: identifying an exit call gateway comprising an exit transition instruction and at least one exit access parameter, said exit access parameters restricting exit from said source domain; identifying an entry call gateway corresponding to said exit call gateway, said entry call gateway comprising a transition instruction and at least one entry access parameter, said entry access parameters restricting access to said target domain; determining that said exit access parameters and said entry access parameters are compatible with each other; and performing a context switch from said source domain to said target domain, when said exit access parameters and said entry access parameters are complied with.