Kernel–Task Memory Isolation Through Trusted Boundary Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automotive electronics control systems, such as those based on OSEK/VDX and AUTOSAR, do not adequately ensure safety and reliability due to the lack of effective memory isolation between the kernel and tasks, allowing unauthorized access and potential vulnerabilities like JOP and ROP attacks.
Innovation Solution
A kernel and task isolation method is introduced, utilizing a trusted base to configure memory protection apparatuses based on memory switching configuration information, ensuring that tasks and the kernel cannot access each other's memory, and implementing memory boundary switching to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the kernel and trusted application share the same memory space without strict isolation, then system complexity is reduced and ease of operation is improved, but safety and reliability deteriorate due to unauthorized memory access
Solution Approach 1:
The patent divides the memory space into distinct segments with different access permissions. The memory protection apparatus segments memory into kernel space and application space, with the trusted application having read-only access to kernel memory segments while common applications have no access. This segmentation ensures safety while managing complexity through structured memory organization.
Solution Approach 2:
The patent introduces a memory protection apparatus as an intermediary layer between the kernel and applications. This intermediary enforces access control policies, allowing the trusted application to safely access kernel memory through controlled interfaces while blocking unauthorized access from common applications, thus improving reliability without requiring complete memory isolation.
2Reliability
If memory protection apparatus is configured with strict access control between kernel and tasks, then safety is improved, but device complexity increases due to additional configuration and verification mechanisms
Solution Approach 1:
The patent performs preliminary configuration of the memory protection apparatus during system initialization. The trusted base configures memory access permissions before tasks are executed, establishing the isolation framework in advance. This preliminary action reduces runtime complexity while ensuring safety, as the access control structure is prepared beforehand rather than dynamically during task execution.
Solution Approach 2:
The trusted application serves itself by having read-only access to kernel memory segments, allowing it to verify kernel operations without requiring full kernel mediation. This self-service capability reduces the burden on the kernel while maintaining isolation, as the trusted application can independently verify system state without complex inter-process communication mechanisms.
3Reliability
If the trusted application has read-only access to kernel memory, then safety is improved by preventing unauthorized modification, but access speed deteriorates due to permission restrictions
Solution Approach 1:
The patent applies different access permissions to different memory segments based on their security requirements. Kernel code segments have read-only permissions for trusted applications, while kernel data segments may have different permissions. This local differentiation of access rights protects critical kernel code while allowing faster access to less sensitive data areas, balancing safety and performance.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments of this application provide a kernel and task isolation method and an apparatus. A separate trusted base is added to a computer system, and the trusted base is independent of a kernel and a task. The trusted base, the task, and the kernel each have an independent memory, and the task and the kernel cannot access memories of each other. When task scheduling needs to be performed, the trusted base configures a memory protection apparatus based on memory switching configuration information stored in the memory of the trusted base. By configuring the memory protection apparatus, a memory access boundary may be switched from the memory of the kernel to the memory of the task, or may be switched from the memory of the task to the memory of the kernel. Access to the memories of the task and the kernel is implemented through memory boundary switching, so as to ensure safety of the task and the kernel.