Firmware Guard Extension for Isolated Runtime Address Remapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems are vulnerable to attacks that exploit design defects, leading to memory corruption and privilege escalation, which can compromise system security and integrity.
Innovation Solution
A firmware guard extension with a converged defense engine that includes a dynamic address map enclave (DAME) and a firmware guard protocol (FGP) to create protected memory regions, remap addresses, and isolate them from the OS/Kernel, preventing address map corruption and privilege escalation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party drivers and OS modules are allowed to access memory directly, then system functionality and adaptability are improved, but system security and reliability deteriorate due to vulnerabilities and privilege escalation attacks
Solution Approach 1:
The patent introduces a firmware guard extension as an intermediary layer between third-party drivers/OS modules and the memory system. This extension includes address mapping logic that translates virtual addresses to physical addresses through a controlled interface, preventing direct memory access while maintaining system functionality. The intermediary enforces security policies and isolates memory domains, allowing adaptable system operation without compromising security.
Solution Approach 2:
The patent segments the memory address space into isolated domains using a firmware extension table that maps virtual addresses to physical addresses in a controlled manner. Each memory region is protected by its own entry in the extension table, creating discrete security zones. This segmentation allows different parts of the system to access only their authorized memory regions, preventing privilege escalation while maintaining overall system functionality.
2Ease of operation
If memory address space is exposed to OS/Kernel, then ease of operation is improved, but memory corruption and privilege escalation become possible
Solution Approach 1:
The firmware guard extension acts as a mediator between the OS/Kernel and the physical memory address space. It provides a controlled interface through address mapping that allows the OS to access memory without exposing the complete physical address map. The extension translates OS virtual addresses to physical addresses through a secure lookup process, maintaining ease of operation while preventing harmful direct access patterns that could lead to memory corruption or privilege escalation.
3Ease of operation
If address mapping is simplified for OS access, then ease of operation is improved, but security isolation is reduced
Solution Approach 1:
The firmware guard extension provides a simplified interface for address mapping while maintaining security isolation through its intermediary address mapping logic. The extension table stores pre-computed virtual-to-physical address mappings that the OS can access through simple lookups, maintaining ease of operation. Meanwhile, the extension enforces security policies by only allowing mappings that pass through its controlled interface, preserving security isolation without complicating OS address access.
Data Source
AI summary
A system for data protection, comprising an address mapping state machine configured to receive address data and protection data and to generate runtime address data, a firmware extension table coupled to a plurality of adders that are configured to receive data derived from the runtime address data and to output mapped runtime address data and a plurality of external components configured to receive the mapped runtime address data and to utilize the mapped runtime address data for one or more predetermined functions.