Hybrid Security Protection for Software Libraries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As the number of software applications increases, maintaining security between them becomes complex, and existing solutions either incur high hardware costs or performance overhead, whether through fully hardware-implemented or software-implemented security measures.
Innovation Solution
A hybrid approach using dedicated security protection hardware and library management software to control calls between secure and less secure domains, allowing for active and inactive software libraries, with the library management software performing switching and additional security operations to virtualize security protocols, reducing hardware overhead and maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a fully hardware-implemented solution is used to enforce security between software libraries, then security protection is fast and performance is high, but hardware resource cost (circuit area and power consumption) increases significantly
Solution Approach 1:
The system segments security management into two parts: a hardware security protection unit that enforces domain boundaries and basic security operations, and a software library management unit that handles library switching and coordination. This segmentation allows critical security functions to run in hardware while less time-sensitive management functions run in software, reducing overall hardware resource requirements.
Solution Approach 2:
The patent introduces a library management software component as an intermediary between the hardware security protection unit and the software libraries. This intermediary handles the complexity of library switching and coordination, allowing the hardware unit to focus on fast security enforcement without managing the complexity of multiple libraries directly.
2Device complexity
If a fully software-implemented security solution is used to manage multiple software libraries, then hardware resource cost is reduced, but processing speed decreases due to interrupts required to invoke operating system security behavior
Solution Approach 1:
The system segments security management into two parts: a hardware security protection unit that enforces domain boundaries and basic security operations, and a software library management unit that handles library switching and coordination. This segmentation allows critical security functions to run in hardware while less time-sensitive management functions run in software, reducing overall hardware resource requirements.
Solution Approach 2:
The library management software performs preliminary actions by pre-configuring and managing the state of software libraries before security operations are needed. By maintaining library metadata and switching state in software beforehand, the system avoids the need for slow operating system interrupts during actual security checks and library transitions.
3Reliability
If each software library is implemented as a separate security domain with dedicated hardware, then security protection between libraries is enforced, but the amount of dedicated hardware resource increases exponentially with the number of libraries
Solution Approach 1:
The hardware security protection unit is designed as a universal, multi-functional component that can enforce security between any number of software libraries without requiring dedicated hardware for each library. The unit manages domain boundaries and security operations dynamically, allowing a single hardware resource to serve multiple libraries through software coordination.
Solution Approach 2:
Instead of creating physical copies of security enforcement hardware for each library, the system uses software to create virtual representations of library domains and their security requirements. The universal hardware unit then enforces these virtual domains through software-configured rules, eliminating the need for exponential hardware proliferation.
Data Source
AI summary
A processing apparatus 2 has a secure domain 90 and a less secure domain 80. Security protection hardware 40 performs security checking operations when the processing circuitry 2 calls between domains. A data store 6 stores several software libraries 100 and library management software 110. The library management software 110 selects at least one of the libraries 100 as an active library which is executable by the processing circuitry 4 and at least one other library 100 as inactive libraries which are not executable. In response to an access to an inactive library, the library management software 110 switches which library is active.