Hardware Exception Control Circuitry Secure Domain State Saving
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face a trade-off between security and performance, particularly in microcontrollers, where securing sensitive data and code requires significant software intervention and overhead, impacting system performance and development efforts.
Innovation Solution
A data processing apparatus with exception control circuitry that performs state saving of registers in hardware before triggering the exception handling routine, ensuring secure data is protected by performing additional state saving when transitioning from a secure to a less secure domain, thereby preventing data modification and reducing the need for proxying through a secure exception handler.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software exception handlers are used to protect secure data during domain transitions, then security is improved, but system performance deteriorates due to increased software intervention overhead
Solution Approach 1:
The patent replaces software-based exception handling with hardware-based exception control circuitry that automatically manages register state saving and domain transitions. This substitution eliminates the performance overhead of software intervention while maintaining security through automatic secure state preservation in dedicated secure registers during transitions between secure and non-secure domains.
Solution Approach 2:
The exception control circuitry automatically performs state saving to secure registers and manages the transition process without requiring software exception handlers. The hardware system serves itself by autonomously protecting secure data during domain transitions, eliminating the need for external software intervention and reducing performance overhead.
2Reliability
If software exception handlers are used to manage secure domain transitions, then data security is improved, but device complexity increases due to additional software development efforts
Solution Approach 1:
The patent replaces complex software exception handling mechanisms with simplified hardware exception control circuitry. This hardware implementation automatically manages secure domain transitions and register state protection, eliminating the need for complex software exception handlers and reducing overall system complexity while maintaining security.
Solution Approach 2:
The hardware exception control circuitry autonomously manages secure data protection during domain transitions without requiring software development efforts. The system self-services by automatically saving secure register states and managing transitions, eliminating the complexity of software-based security management.
3Reliability
If all register states are saved during exception transitions, then security is improved, but processing speed deteriorates due to increased state saving overhead
Solution Approach 1:
The patent segments registers into secure and non-secure groups, and only saves the state of secure registers during domain transitions. The exception control circuitry identifies and preserves only the necessary secure register states in dedicated secure registers, rather than saving all register states. This selective approach maintains security while reducing the overhead of state saving operations and improving processing speed.
Solution Approach 2:
The patent extracts only the essential secure register states that need protection during domain transitions, rather than saving all register states. The exception control circuitry identifies and saves only the necessary secure data in secure registers, eliminating unnecessary state saving operations and reducing processing overhead while maintaining security.
Data Source
AI summary
A data processing apparatus and method are provided for handling exceptions, including processing circuitry configured to perform data processing operations in response to program code, said circuitry including exception control circuitry. A plurality of registers are provided including a first and second subsets of registers, and a data store. The data store includes a secure region and a less secure region, wherein the secure region is for storing data accessible by the processing circuitry when operating in a secure domain and not accessible by the processing circuitry when operating in a less secure domain. The exception control circuitry performs state saving of data from the first subset of registers before triggering the processing circuitry to perform an exception handling routine corresponding to the exception. Where background processing was performed by the processing circuitry in the secure domain, the exception control circuitry performs additional state saving of the data.