Exception Vector Secure Mode Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in securely switching between secure and non-secure domains, with increasing complexity making it difficult to ensure the security of sensitive data from being accessed by malicious applications.
Innovation Solution
A processor operable in multiple modes and domains, with a well-defined mechanism for switching between secure and non-secure modes using an exception mechanism, where switching requests are handled as exceptions directed by an exception vector, and a monitor mode controls all switching to prevent data leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the operating system provides security mechanisms to protect sensitive data from malicious applications, then the security of secure data is improved, but the complexity of the operating system increases
Solution Approach 1:
The system is divided into distinct secure and non-secure domains with separate execution environments. The processor can operate in either secure mode or non-secure mode, creating clear segmentation that isolates sensitive data and operations from potentially malicious applications. This segmentation provides inherent security without requiring complex software protection mechanisms within the operating system.
Solution Approach 2:
An exception vector mechanism serves as an intermediary for controlled transitions between secure and non-secure modes. When mode switching is required, the system uses well-defined exception handlers that mediate the transition safely, ensuring that secure data access is properly controlled. This intermediary approach simplifies security management by providing standardized entry and exit points from secure contexts.
2Adaptability or versatility
If the operating system becomes larger and more complex to handle various applications, then the functionality and adaptability of the system is improved, but the ability to ensure sufficient security within the operating system deteriorates
Solution Approach 1:
The processor architecture separates secure and non-secure functionalities into distinct operational modes. Applications requiring secure data access execute in secure mode with appropriate protection, while standard applications run in non-secure mode. This segmentation allows the operating system to grow in functionality without compromising security, as each mode has its own protected execution environment and access controls.
Solution Approach 2:
Security measures are applied locally where needed rather than throughout the entire operating system. Secure data and operations receive enhanced protection through dedicated secure mode execution, while non-critical operations can run in the more flexible non-secure mode. This localized approach to security maintains system functionality while reducing the overall complexity burden on the operating system.
3Adaptability or versatility
If mode switching between secure and non-secure domains is allowed for flexibility, then the adaptability of the system is improved, but the risk of unauthorized access to secure data increases
Solution Approach 1:
Exception vectors serve as controlled intermediaries for mode switching operations. Rather than allowing direct or arbitrary transitions between secure and non-secure modes, the system routes mode switching through well-defined exception handlers that verify authorization and maintain security invariants. This intermediary mechanism enables flexible mode switching when needed while preventing unauthorized access attempts.
Solution Approach 2:
The system implements controlled feedback mechanisms through exception handling that monitor and respond to mode switching requests. When a mode transition is attempted, the exception vector mechanism provides feedback by validating the request and either permitting the transition under controlled conditions or blocking it to prevent security violations. This feedback loop maintains security while allowing legitimate mode switching.
Data Source
AI summary
There is a provided a data processing system comprising:a processor operable in a plurality of modes and either a secure domain or a non-secure domain including:at least one secure mode being a mode in said secure domain; andat least one non-secure mode being a mode in said non-secure domain;whereinwhen said processor is executing a program in a secure mode said program has access to secure data which is not accessible when said processor is operating in a non-secure mode; and whereinsaid processor is responsive to a switching request to initiate a switch between a secure mode and a non-secure mode under control of a mode switching program starting at a location specified by an exception vector associated with said switching request.