Memory Controller Page Table Attribute Key Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems lack effective isolation and security between memory regions allocated to different users or applications, with existing encryption methods not adequately preventing rogue access, especially at the memory interface.
Innovation Solution
Implementing a memory controller with an encryptor and access manager that uses page table attributes to manage memory access keys, ensuring each memory region is associated with a unique key, and validating access requests to enhance security and isolation between clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If memory regions are shared between multiple users/applications, then memory resource utilization is improved, but security isolation between clients deteriorates
Solution Approach 1:
The patent segments memory space into distinct memory regions, each associated with specific access keys. The page table is divided into multiple page table entries (PTEs), each containing access key information for different memory regions. This segmentation allows multiple clients to share memory resources while maintaining security isolation through key-based access control.
Solution Approach 2:
The patent introduces an intermediary security protocol at the memory interface that mediates access between clients and memory regions. The access manager acts as a mediator that validates client access keys against stored PTE information before granting memory access, providing security isolation while enabling shared access.
2Reliability
If encryption is implemented at memory interface, then security against rogue access is improved, but device complexity increases
Solution Approach 1:
The patent merges the encryption function with the existing error correction code (ECC) logic in the memory controller. By combining these security and reliability functions into a single logical element, the patent achieves strong security protection without proportionally increasing device complexity, as the merged structure shares hardware resources and control pathways.
Solution Approach 2:
The memory controller is designed with universal security protocols that can operate in multiple modes (isolation only, encryption and error correction, or both). The same hardware infrastructure supports both security encryption and error correction functions, reducing overall complexity compared to implementing separate dedicated systems for each function.
3Reliability
If access validation is performed for each memory request, then security isolation is improved, but processing speed deteriorates
Solution Approach 1:
The patent performs preliminary action by pre-configuring page table entries with access key information during memory region setup. This allows the access manager to quickly validate client access keys by comparing against pre-stored PTE data, rather than performing complex validation operations for each memory request, thus maintaining high access speed while ensuring security.
Data Source
AI summary
Encrypted memory access using page table attributes is disclosed. One example is a memory system including a memory controller at a memory interface. The memory controller includes an encryptor to control a plurality of memory access keys respectively associated with memory regions, where each memory region is allocated to a respective client, and an access manager to receive an access request from a client, the access request including a client access key to access a memory element. The access manager looks up a memory access key from a page table attribute associated with a physical address of the memory element, and determines if the access request is valid by comparing the client access key with the memory access key associated with the memory region that includes the memory element. Based on the determination and a mode of operation, the access manager provides a response to the access request.