Subsystem Firewalls for Secure Memory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems lack effective mechanisms for secure memory access control between components of an integrated circuit, particularly in preventing unauthorized access and ensuring secure configuration of firewalls within IoT devices.
Innovation Solution
The implementation of configurable firewalls that block communication from subsystems upon boot and allow secure code to configure access ranges to memory, preventing non-secure code from configuring the firewalls, thereby ensuring secure and selective access to memory and peripherals based on predefined ranges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If firewalls are configured to allow broad memory access for system operation, then system functionality and ease of operation are improved, but security against unauthorized access deteriorates
Solution Approach 1:
The memory space is segmented into multiple address ranges, each with different access permissions. The firewall configuration divides memory access into secure regions (accessible only to secure code) and non-secure regions (accessible to normal code), allowing the system to provide broad access where needed while restricting access to critical areas.
Solution Approach 2:
Different security properties are applied to different parts of the memory space. Instead of applying a uniform security policy, the firewall allows specific address ranges to have different access permissions - some ranges allow broad access for functionality, while others enforce strict access control for security, thus resolving the contradiction between ease of operation and security.
2Adaptability or versatility
If firewalls are made configurable by any code for flexibility, then adaptability is improved, but security against malicious configuration deteriorates
Solution Approach 1:
The firewall configuration is performed in advance during system initialization or boot-up, before normal application code executes. Secure code establishes the firewall rules and access permissions beforehand, preventing malicious code from later modifying the firewall configuration to gain unauthorized access.
Solution Approach 2:
A trusted intermediary mechanism (the secure code execution environment) mediates the firewall configuration process. This intermediary verifies and validates configuration requests, allowing flexible adaptation of firewall rules while preventing malicious code from directly configuring the firewall with harmful settings.
3Object-affected harmful factors
If strict access control is enforced for all memory regions, then security is improved, but system functionality and productivity deteriorate
Solution Approach 1:
The memory address space is segmented into multiple regions with different security requirements. Critical regions (such as secure storage, configuration areas) have strict access control enforced by the firewall, while non-critical regions allow broader access for efficient system operation, thus maintaining security without sacrificing productivity.
Solution Approach 2:
Different levels of access control are applied locally to different memory regions based on their security requirements. High-security regions receive strict protection while low-security regions permit efficient access patterns, resolving the contradiction between security and productivity through localized security policies.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed technology is generally directed to firewalls. In one example of the technology, a first firewall is used such that communication is blocked from a first subsystem of a device upon boot of the device. The first firewall is enabled to be configured by secure code subsequent to boot such that code that is not secure code is prevented from configuring the first firewall. After configuration of the first firewall, based on the configuration, the first firewall is used to selectively allow the first subsystem access to the first memory based on ranges of addresses of the first memory configured as accessible to the first subsystem.