Fine Granularity Memory Protection via Segmented Entries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory protection techniques, such as system pages and protection rings, provide coarse granularity protection, which is inefficient for small data structures and burdensome in concurrent processing scenarios, leading to a need for fine granularity memory protection without additional inter-process communication or control transfer inefficiencies.
Innovation Solution
The implementation of protection entries that separate memory or code into blocks with specific access control fields, allowing for fine granularity protection by specifying read, write, execute, and other access levels, enabling secure and efficient data sharing and synchronization among system entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If coarse granularity protection at the page level is used, then memory protection is provided, but efficiency is reduced and overhead increases for small data structures
Solution Approach 1:
The patent divides memory protection into fine-grained segments using protection entries at byte-level or small block-level granularity, rather than coarse page-level protection. Each protection entry covers a specific memory range with specific access rights, allowing precise protection of small data structures without protecting entire pages, thus improving efficiency while maintaining security.
Solution Approach 2:
The patent applies different protection characteristics to different memory regions through protection entries. Each protection entry can have customized read, write, execute, and other access rights tailored to the specific needs of that memory region, enabling local optimization of protection granularity and access control rather than uniform page-level protection.
2Reliability
If system pages and protection rings are used, then memory security is improved, but inter-process communication overhead increases
Solution Approach 1:
The patent extracts the essential protection functionality from complex system pages and protection rings mechanisms, creating lightweight protection entries that provide necessary security without the overhead of full page table management and ring-based privilege switching. This extraction maintains security while reducing communication and context-switching overhead.
3Reliability
If entire pages of memory are accessed for control transfer, then protection is maintained, but transfer burden increases
Solution Approach 1:
The patent segments memory access control into fine-grained protection entries that can be transferred independently without moving entire pages. Protection entries can be copied or transferred between processes containing only the essential protection information for specific memory ranges, dramatically reducing the burden of control transfer while maintaining protection integrity.
Data Source
AI summary
Protection entries and techniques for providing fine granularity computer memory protection are described herein. A method of protecting a computer memory may include separating or parsing the computer memory, containing data or code, into blocks and creating protection entries for each block. The protection entries optionally include a reference field for identifying a block of memory, and a protection field for specifying one or more levels of access to the identified block of memory. The protection entries may then be used to pass messages between various system entities, the messages specifying one or more levels of access to the one or more blocks of memory or code.