Memory Firewall for Shared Pool Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing systems with multiple processors connected to a shared memory, there is a lack of coordination between processors under different operating system instances, leading to potential data corruption and access conflicts, particularly in multitenant environments where different tenants' data needs to be isolated.
Innovation Solution
Implementing a firewall mechanism between processors and shared memory to regulate access based on configuration data, ensuring that only authorized processors can access specific memory portions and that access requests are validated by a security agent to prevent malicious alterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple processors are allowed to access shared memory without coordination, then system productivity and resource utilization are improved, but data corruption and access conflicts occur
Solution Approach 1:
A firewall mechanism is introduced as an intermediary component between processors and shared memory. The firewall receives access requests from processors, validates them against configuration data, and either permits or blocks access to specific memory portions. This mediator resolves the contradiction by enabling concurrent access (maintaining productivity) while enforcing access control rules (ensuring data integrity and preventing corruption).
2Adaptability or versatility
If firewall configuration data is made accessible to operating systems for modification, then system adaptability and ease of operation are improved, but security vulnerabilities and malicious alterations increase
Solution Approach 1:
The firewall configuration data structure is made dynamic with different access modes. Configuration data can be in a locked state (preventing modifications) or an unlocked state (allowing modifications by authorized entities). The system transitions between these states based on security conditions, enabling adaptability when secure while preventing vulnerabilities when locked. This dynamic approach resolves the contradiction between flexibility and security.
Solution Approach 2:
The system takes preliminary anti-action by detecting attempts to access or modify configuration data and preventing unauthorized changes before they can cause security vulnerabilities. The firewall monitors and controls access to its own configuration data, blocking malicious alterations before they compromise system security, thus resolving the contradiction between accessibility and security.
Data Source
AI summary
Techniques for a firewall to determine access to a portion of memory are provided. In one aspect, an access request to access a portion of memory within a pool of shared memory may be received at a firewall. The firewall may determine whether the access request to access the portion of memory is allowed. The access request may be allowed to proceed based on the determination. The operation of the firewall may not utilize address translation.