Memory Access Control via System State Registers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems are vulnerable to attacks that modify memory contents, such as boot-level code, allowing attackers to hijack control flow and access sensitive information, which standard anti-virus and detection software often fail to detect.
Innovation Solution
Implementing a memory system that restricts access to memory locations based on the value of control registers, using access rules stored within the memory system, and allowing only trusted applications to modify these registers through secure hash algorithms, thereby preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory access is restricted based on control register values, then security against unauthorized access and attacks is improved, but device complexity increases due to access rules and control register management
Solution Approach 1:
The patent introduces control registers as intermediary components that mediate between the processor and memory system. These registers store system state information and control access permissions, acting as a security layer without requiring complex changes to the core memory architecture. The access rules use these intermediary registers to determine whether to grant or deny access requests.
Solution Approach 2:
The memory system is segmented into different access zones controlled by distinct access rules. Each access rule independently evaluates control register values to determine access permissions for specific memory regions. This segmentation allows security policies to be applied granularly without requiring complete system redesign.
2Reliability
If access rules are stored within the memory system, then access control is improved by enabling restrictions at the memory level, but manufacturing complexity increases
Solution Approach 1:
The memory system is designed with multi-functionality, serving both as data storage and as a security enforcement point. The same memory controller that manages read/write operations also evaluates access rules and control register values to determine access permissions. This eliminates the need for separate hardware security modules.
Solution Approach 2:
The memory system performs self-service security enforcement by autonomously evaluating access rules against control register values and granting or denying access requests without external intervention. The controller internally manages the security policy evaluation, reducing the need for additional external security infrastructure.
3Reliability
If control registers can only be modified by trusted applications through secure hash algorithms, then protection against malicious code is improved, but ease of operation decreases
Solution Approach 1:
The control registers use cryptographic hash values as parameters to represent system state. Instead of storing raw system configuration data, the registers store hash values that change based on system state modifications. This parameter transformation enables secure verification while maintaining operational simplicity for trusted applications.
Solution Approach 2:
The system preemptively prevents malicious code from modifying control registers by requiring cryptographic verification through secure hash algorithms. Before any modification can occur, the trusted application must prove its authenticity through the hash verification process, blocking potential attacks in advance.
Data Source
AI summary
Disclosed in some examples are memory systems, computing systems, and machine readable mediums for protecting memory at identified addresses based upon access rules defining permissible access to the identified memory addresses that depends on the value of one or more registers stored in the memory system. In some examples, the value of the registers (e.g., a Platform Configuration Register) may depend on a state of a computing device in which the memory system is installed.