Indirect Memory Access Security System for Authorized Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory access systems lack robust security validation for indirect memory accesses, making memories susceptible to corruption and degrading the availability of functional circuits due to limited security and the need for multiple access requests for multiple addresses.
Innovation Solution
An integrated circuit (IC) with a security system that validates functional circuits and their requests, determining instruction sequences based on security and privilege attributes, and executes authorized indirect memory accesses, allowing single request packets to cover multiple addresses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security validation is added to indirect memory accesses, then memory security is improved, but device complexity increases
Solution Approach 1:
The security system is segmented into distinct functional modules: a security system module that receives and validates request packets, a functional identifier extraction module that extracts functional IDs from instruction sequences, and a validation logic module that compares functional IDs against authorized lists. This segmentation allows each module to perform a specific security function independently, improving overall security while managing complexity through modular design.
Solution Approach 2:
The patent introduces an intermediary security system that acts as a mediator between the functional circuit and the memory controller. This intermediary validates request packets by extracting functional IDs from instruction sequences and comparing them against authorized functional IDs stored in the security system, thereby securing indirect memory accesses without requiring fundamental changes to the existing memory access architecture.
2Adaptability or versatility
If multiple access requests are used for multiple addresses, then memory access coverage is improved, but productivity deteriorates
Solution Approach 1:
The patent merges multiple individual memory access requests into a single batched request packet that can access multiple memory addresses simultaneously. The security system validates the entire batch of addresses in one operation by extracting and verifying the functional ID from the instruction sequence, thereby improving productivity while maintaining comprehensive memory access coverage.
Solution Approach 2:
The system performs preliminary validation of the functional ID from the instruction sequence before processing individual memory addresses. By extracting and validating the functional ID upfront, the system prepares the authorization context in advance, allowing subsequent batched memory accesses to be processed more efficiently without repeated validation overhead for each address.
Data Source
AI summary
An integrated circuit (IC), including a functional circuit and a security system, is disclosed. The functional circuit generates a request packet for an indirect memory access of a memory. The security system validates the functional circuit based on a security attribute and a functional identifier of the functional circuit. Based on the request packet and the validation of the functional circuit, the security system identifies an instruction sequence associated with the indirect memory access. Further, the security system determines a type of the indirect memory access based on the instruction sequence, and validates the type of the indirect memory access based on the security attribute and the request packet. Based on the validation of the type of the indirect memory access, the instruction sequence is executed, thereby facilitating the indirect memory access for the functional circuit.