Memory Access Control Using Context-Based Permission Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing apparatuses struggle to balance the compatibility between trusted and less trusted code, as most trusted code may have access to all instructions and system registers, while it is desirable to restrict access for less trusted code.
Innovation Solution
Implementing an apparatus with instruction fetch circuitry, processing circuitry, register circuitry, and security circuitry to determine permissions based on execution context and region identifiers, using a permissions disabling table to prohibit certain operations and accesses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If all instructions and system registers are made accessible to trusted code, then functionality and versatility are improved, but security and access control are worsened
Solution Approach 1:
The patent segments the instruction set and system registers into multiple categories or groups with different access permissions. Instead of treating all instructions uniformly, the system divides them into privileged and non-privileged categories, allowing fine-grained control over which instructions can be executed by different trust levels of code.
Solution Approach 2:
The patent applies different access control policies to different instructions and system registers based on their security requirements. Each instruction or register can have its own permission attributes, allowing the system to provide high-level access to safe instructions while restricting access to sensitive instructions, thereby achieving both versatility and security.
2Reliability
If access restrictions are imposed on less trusted code, then security is improved, but device complexity and implementation difficulty are worsened
Solution Approach 1:
The patent implements a universal access control mechanism that can be applied across all instructions and system registers through a common framework. The permission checking logic and attribute storage structure are designed to handle multiple types of access control requirements using the same underlying system, reducing overall implementation complexity despite the fine-grained control provided.
Solution Approach 2:
The system incorporates automatic permission verification that is integrated into the instruction execution pipeline. The access control mechanism automatically checks permissions and enforces restrictions without requiring manual intervention or complex external control logic, thereby simplifying the overall system implementation while maintaining strong security.
Data Source
AI summary
Apparatuses, methods, computer programs and computer-readable storage media are disclosed. An instruction associated with an instruction fetch address is fetched. In response to the instruction an operation defined by the instruction is conditionally performed. Values indicative of a current processing state of processing are held in registers comprising an execution context identifier register holding an execution context identifier indicative of a current process. A current region identifier is determined based on the instruction fetch address. A permissions index is determined based on the current region identifier and the execution context identifier. The permissions index is used to index into a permissions disabling table to determine a set of permission disables and whether or not the operation is prohibited is determined based on the set of permission disables.