Dual Trust Architecture for Secure Stack Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In multiuser single address space subsystems, trusted and untrusted routines share the same call stack, leading to potential accidental or malicious modifications of system state, causing integrity and security violations like Information Disclosure, Denial of Service, and Elevation of Privilege, and existing secure stack mechanisms are resource-intensive and limited in high-performance environments.
Innovation Solution
A dual trust architecture is implemented, using a control module and trusted routine table to switch between trusted and reduced-trust modes of operation, employing the Branch and Set Authority instruction to manage transitions without relying on system services, allowing authorized execution mode changes and protecting trusted data from untrusted routines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure stack mechanism (Request Block chain) is used to protect system state from modification, then system integrity and security are improved, but resource consumption increases and performance decreases
Solution Approach 1:
The patent segments the call stack into trusted and untrusted portions by maintaining a separate active trusted routine list. This allows the system to protect only the critical trusted portion while leaving the untrusted portion accessible, thereby reducing the overhead of protection mechanisms while maintaining security for essential system state.
Solution Approach 2:
The patent applies protection selectively to specific portions of the stack (trusted routines) rather than the entire stack. By using local quality, the system provides strong protection where needed (trusted system routines) while allowing free access where appropriate (untrusted application routines), optimizing both security and performance.
2Reliability
If operating system services are used to enforce secure stack protection, then security is improved, but resource overhead increases
Solution Approach 1:
The patent implements self-service by enabling the application itself to manage its trusted routine list and enforce protection boundaries without continuous operating system intervention. The control module switches between trusted and untrusted modes autonomously based on the execution context, eliminating the need for expensive OS service calls for each stack operation.
Solution Approach 2:
The patent performs preliminary action by pre-establishing the active trusted routine list and setting up protection boundaries before execution begins. The control module is configured in advance to automatically switch modes based on predefined conditions, avoiding the need for runtime OS service interventions.
3Reliability
If the entire call stack is protected from modification, then system security is improved, but the ability to execute untrusted routines efficiently is reduced
Solution Approach 1:
The patent divides the call stack into segmented regions: trusted routines listed in the active trusted routine list that require protection, and untrusted routines that do not. This segmentation allows the system to maintain security for critical components while providing full execution flexibility for application code.
Solution Approach 2:
The patent introduces dynamic mode switching between trusted and untrusted states based on the current execution context. The control module automatically transitions between modes as routines are called and returned from, allowing the protection level to adapt dynamically to the current operational requirements.
Data Source
AI summary
Mechanisms for executing a software routine in an application executing as a multi-user single address space subsystem in an operating environment having a trusted mode of operation for trusted routines and a reduced-trust mode of operation for untrusted routines. The application includes a control module for execution as a trusted routine and a trusted routine table including identifiers of trusted routines. The control module performs switches between a trusted mode of operation for execution and a reduced trust mode of operation based on various determinations regarding the nature of a calling routine being trusted or untrusted, a call stack, and whether the calling routine is being restored or not from the call stack.