Dynamic Memory Protection for Computational Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage systems lack effective dynamic memory protection mechanisms for computational storage devices, especially in multi-tenant environments, where memory usage is dynamic and pre-allocation is not viable, leading to security and efficiency issues.
Innovation Solution
The system implements dynamic memory protection by assigning and restricting memory resources based on commands, using computational resources like CPUs, GPUs, and FPGAs, and includes mechanisms to pause program execution if it attempts to access unauthorized memory regions, ensuring secure and efficient memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pre-allocation of memory resources is used, then memory protection is simplified, but memory usage efficiency deteriorates in dynamic multi-tenant environments
Solution Approach 1:
The patent implements dynamic memory protection by establishing memory protection domains that are created and configured at runtime based on program execution needs. The memory management unit dynamically determines whether to enable memory protection domain checks for each program execution, allowing the system to adapt between protected and unprotected modes based on the specific tenant and program requirements, thus resolving the contradiction between reliable protection and efficient usage.
2Productivity
If dynamic memory assignment is implemented, then memory usage efficiency is improved, but memory protection complexity increases
Solution Approach 1:
The patent segments memory into distinct memory protection domains, where each domain corresponds to a specific program execution context. The memory management unit divides the memory address space into protected regions and unprotected regions based on the execution mode. This segmentation allows dynamic memory assignment to different programs while maintaining protection boundaries, reducing the complexity of managing protection for entire memory spaces.
Solution Approach 2:
The patent introduces a memory management unit as an intermediary between the program execution unit and the memory resources. This intermediary component handles the complexity of memory protection by automatically determining whether to enforce memory protection domain checks based on stored configuration information. The mediator absorbs the protection logic complexity, allowing the rest of the system to benefit from simplified memory access while maintaining security.
3Reliability
If memory protection domains are established for each program, then data security is improved, but system overhead increases
Solution Approach 1:
The patent implements dynamic establishment of memory protection domains where domains are created only when needed for specific program executions rather than being permanently established for all programs. The memory management unit dynamically determines whether to enable protection domain checks based on the program type and tenant requirements. This dynamic approach reduces system overhead by avoiding unnecessary protection domain setup and validation for programs that do not require enhanced security, while still providing strong protection when needed.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Provided are systems, methods, and apparatuses for managing memory on a computational storage device is described. A system for managing memory comprises: a controller; one or more computational resources; and one or more memory resources, wherein the system is configured to: receive a command specifying an amount of computational resources and an amount of memory resources associated with a program; and process the command by the controller, wherein the processing includes dynamically assigning a portion of the one or more computational resources and assigning a portion of the one or more memory resources based on the command for use by the program. A method can include: receiving, by a controller, a command specifying an amount of computational resources and an amount of memory resources associated with a program; and processing the command by the controller, wherein the processing includes dynamically assigning a portion of one or more computational resources and assigning a portion of one or more memory resources based on the command for use by the program.