In-Memory Compute Circuitry for Isolated Shared Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory sharing implementations between computing platforms lack strict isolation mechanisms, leading to security vulnerabilities such as unrestricted read/write access, lack of real-time data inspection, and performance bottlenecks, and are vulnerable to side channel attacks and unauthorized access.
Innovation Solution
A hardware-enforced, policy-driven shared memory model using controlled shared memory (COSM) management circuitry with two levels of isolation: host-level access control and data-level inspection, incorporating self-destructive memory buffers to prevent data persistence and unauthorized retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based memory isolation via hypervisors or containerization is used, then memory sharing between computing platforms is enabled, but security vulnerabilities arise including unrestricted read/write access, lack of real-time data inspection, and side channel attacks
Solution Approach 1:
The patent divides memory access control into two distinct levels: host-level isolation using permission matrices that control which hosts can access which memory regions, and data-level isolation using verification circuitry that inspects individual data transactions. This segmentation allows each level to address specific security concerns independently, resolving the contradiction between comprehensive security and manageable complexity.
Solution Approach 2:
The patent introduces verification circuitry as an intermediary component between memory hosts and shared memory regions. This intermediary performs real-time data inspection and policy enforcement, acting as a mediator that prevents unauthorized access and side channel attacks without requiring complex software-based isolation mechanisms, thus improving security while maintaining system simplicity.
2Reliability
If coarse-grained access control is used, then implementation simplicity is maintained, but deep data-level security and real-time data inspection are lacking
Solution Approach 1:
The patent segments access control into two distinct layers: host-level control through permission matrices that manage which computing platforms can access shared memory, and data-level control through verification circuitry that inspects individual data transactions. This segmentation enables fine-grained data-level security without overwhelming complexity, as each layer handles specific aspects of access control independently.
Solution Approach 2:
The verification circuitry performs automatic data-level inspection and policy enforcement at the hardware level, eliminating the need for complex software-based security mechanisms. This self-service approach at the hardware level provides deep data-level security while keeping the overall system architecture simple and efficient.
3Productivity
If in-memory compute circuitry is used, then computation speed is improved, but data persistence risks and unauthorized retrieval vulnerabilities increase
Solution Approach 1:
The verification circuitry acts as an intermediary that monitors and controls all data transactions involving in-memory compute circuitry. It performs real-time inspection of compute operations and enforces policies that prevent unauthorized data retrieval and control data persistence, thereby enabling fast in-memory computation while mitigating security risks.
Solution Approach 2:
The verification circuitry provides continuous feedback on data transactions to enforcement logic, which adjusts access control decisions in real-time based on observed behavior. This feedback mechanism enables the system to maintain high computation speeds while dynamically responding to potential security threats and preventing unauthorized data persistence or retrieval.
Data Source
AI summary
Examples include techniques associated for use of in-memory compute circuitry in shared memory. Examples include the shared memory being included on or at an externally attached shared memory device. The shared memory at the externally attached shared memory device can be shared between multiple domains hosted by one or more host computing platforms. Examples include establishment of multiple isolations for in-memory compute requests for in-memory compute operations to the shared memory by one or more domains that can access the shared memory.