Memory Control Circuitry for Privileged Mode Instruction Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems face security vulnerabilities where malicious or accidental execution of program instructions can occur by switching from user mode to privileged mode, allowing access to secure memory regions, especially when instructions are stored in writable user mode areas.
Innovation Solution
Implementing memory control circuitry that manages access based on hardware modes, preventing execution of program instructions from user-mode writable memory regions in privileged mode by using a security flag to enforce access restrictions, allowing write access to specific memory portions based on mode and flag settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the processor is allowed to execute program instructions from memory areas writeable in user mode while operating in privileged mode, then the system gains flexibility in executing code, but security is compromised allowing malicious or erroneous execution of untrusted instructions
Solution Approach 1:
The patent segments memory into distinct portions with different access characteristics (first portion writeable in user mode, second portion not writeable in user mode) and segments processor operation into different hardware modes. The memory control circuitry enforces that when in privileged mode, the processor can only execute instructions from the second portion of memory, preventing execution of potentially malicious code from user-mode writable areas while maintaining flexibility for legitimate privileged operations.
2Adaptability or versatility
If the privileged mode has access to more memory areas than user mode, then the privileged mode can access secure regions, but this creates a vulnerability where malicious instructions in user-mode areas can be executed when switching to privileged mode
Solution Approach 1:
The patent introduces memory control circuitry as an intermediary between the processor and memory. This intermediary monitors and controls memory access based on the current hardware mode, preventing the processor from reading or executing instructions from user-mode writable memory areas when operating in privileged mode. The control circuitry acts as a security gatekeeper that maintains the intended security model while allowing legitimate privileged access to appropriate memory regions.
3Reliability
If memory control circuitry prevents reading instructions from user-mode writable areas in privileged mode, then security is enhanced, but this may restrict legitimate execution of privileged code from such areas
Solution Approach 1:
The patent applies different access rules to different portions of memory based on their security characteristics. The first portion of memory (writeable in user mode) is subject to restrictive access control when the processor is in privileged mode, preventing instruction execution from this area. The second portion of memory (not writeable in user mode) is subject to fewer restrictions and allows privileged execution. This local differentiation of access policies enables security enhancements without unnecessarily restricting legitimate operations.
Data Source
AI summary
An apparatus for processing data 2 includes a processor 8, a memory 6 and memory control circuitry 12. The processor 8 operates in a plurality of hardware modes including a privileged mode and a user mode. When operating in the privileged mode, the processor 8 is blocked by the memory control circuitry 12 from fetching instructions from memory address regions 34, 38, 42 within the memory 6 which are writeable within the user mode if a security flag within register 46 is set to indicate that this blocking mechanism is active.