Granule Protection Data Integrity Checks for Address-Space Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face security vulnerabilities due to the compromise of operating systems or hypervisors, leading to unauthorized access to sensitive information, especially when using complex software processes that require fine-grained access control across multiple physical address spaces, where storing granule protection information in hardware-protected storage is impractical due to high costs and vulnerabilities in tampering.
Innovation Solution
Implementing integrity checking circuitry to verify the integrity of granule protection data blocks stored in vulnerable memory, using lightweight encryption and data integrity checks based on valid encodings or integrity signatures, ensuring secure access control without the need for extensive hardware-protected storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If granule protection information is stored in hardware-protected storage, then security against tampering is improved, but hardware cost and device complexity increase significantly
Solution Approach 1:
The patent introduces an intermediary integrity checking mechanism that operates between the vulnerable memory storage and the security-critical access control logic. This intermediary layer performs cryptographic verification of granule protection entries without requiring the entire storage infrastructure to be hardware-protected, thus resolving the contradiction between security and hardware cost.
Solution Approach 2:
The patent creates a copy of the granule protection information in a verified integrity state. Instead of storing protection data directly in secure hardware, the system stores copies in vulnerable memory and uses cryptographic signatures to verify their integrity before use, eliminating the need for expensive hardware protection while maintaining security.
2Device complexity
If granule protection information is stored in vulnerable memory, then hardware cost is reduced, but security against tampering deteriorates
Solution Approach 1:
The patent applies preliminary action by verifying the integrity of granule protection entries before they are used for access control decisions. The integrity checking circuitry performs cryptographic verification in advance, ensuring that even if the storage memory is vulnerable, the protection information remains trustworthy when needed.
Solution Approach 2:
The system implements feedback through continuous integrity verification. The integrity checking circuitry monitors the protection information and provides feedback to the access control logic, allowing the system to detect and respond to tampering attempts in real-time, thus maintaining security despite using vulnerable memory storage.
3Reliability
If integrity checking is performed on granule protection data blocks, then security against tampering is improved, but processing time and performance deteriorate
Solution Approach 1:
The patent performs integrity checking in advance during the data loading phase rather than during the critical access control phase. By verifying the integrity of granule protection entries before they are used for filtering memory access requests, the system minimizes the impact on processing time while maintaining security.
Solution Approach 2:
The integrity checking operation is designed to continue the useful action of data loading without creating a significant pause. The verification process is integrated into the existing memory access flow, allowing integrity checks to occur concurrently with or immediately following the data retrieval operation, thus maintaining system performance.
4Measurement precision
If fine-grained access control is implemented across multiple physical address spaces, then security precision is improved, but device complexity increases
Solution Approach 1:
The patent segments the access control function into discrete units called granule protection entries, each managing a specific portion of the physical address space. This segmentation allows fine-grained control to be achieved through multiple simple, independent entries rather than a single complex control mechanism, thus reducing overall system complexity while maintaining precision.
Solution Approach 2:
The system applies local quality by providing customized access control properties to different portions of the address space through individual granule protection entries. Each entry can have its own protection characteristics tailored to its specific address range, enabling fine-grained control without requiring a complex centralized control system.
Data Source
AI summary
Address translation circuitry translates a target virtual address (VA) specified by a memory access request into a target physical address (PA) associated with a selected physical address space (PAS) selected from among a plurality of PASs. A granule protection data block is loaded from memory comprising at least one granule protection entry (GPE), each GPE corresponding to a respective granule of PAs and specifying granule protection information (GPI) indicating which of the PASs is an allowed PAS. Filtering circuitry determines whether the memory access request should be allowed to access the target PA, based on whether the selected PAS is indicated as an allowed PAS by the GPI in a target granule protection entry (GPE). Integrity checking circuitry performs a data integrity check on the granule protection data block loaded from memory, and signals a fault when the data integrity check fails.