Memory Management Metadata for Address Translation Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory management systems face challenges in protecting virtual-to-physical address translation from malicious attacks, such as double mapping, which can lead to security breaches and increased latency due to hypervisor-based protection methods.
Innovation Solution
A memory management apparatus and method that tracks and generates metadata for virtual and physical addresses in the address translation table, intercepts updating operations, and decides whether to perform them based on the presence of mappings, thereby detecting and preventing malicious attacks while providing similar or improved security without the latency of hypervisor-based protection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hypervisor-based protection or alternative mappings are used to protect the address translation table from malicious attacks, then security is improved, but execution latency increases significantly
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing alternative mappings in the address translation table before any malicious attack occurs. When a malicious update is detected, the system can immediately switch to the pre-prepared alternative mapping without requiring hypervisor intervention or complex runtime computations, thus maintaining security while avoiding latency.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of alternative mappings that act as a mediator between the address translation table and potential malicious attacks. These alternative mappings serve as a protective layer that can be activated quickly without involving the hypervisor, reducing the latency associated with security checks.
2Speed
If the MMU is turned off to gain direct access to physical memory pages, then access speed is improved, but security protection is lost
Solution Approach 1:
The patent prepares alternative mappings in advance that encode security attributes directly. This allows the MMU to remain enabled and continue providing security protection while still allowing fast direct access to physical memory pages, as the security checks are embedded in the pre-computed mappings rather than requiring runtime MMU interventions.
3Adaptability or versatility
If the address translation table is made writable to allow updates, then flexibility is improved, but vulnerability to malicious attacks increases
Solution Approach 1:
The patent pre-computes alternative mappings with embedded security attributes and stores them in the address translation table before any updates are attempted. This allows the table to remain flexible and writable for legitimate updates while protecting against malicious attacks, as the alternative mappings serve as a pre-prepared safety net that can be activated immediately if malicious intent is detected.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure relates to a memory management apparatus and method that provide virtual-to-physical address translation in a protected manner. The memory management apparatus and method are based on tracking virtual and physical addresses provided with mappings in an address translation table and generating metadata distinguishing between the virtual and physical addresses with and without the mappings in the address translation table. Subsequently, when a request for creating a new mapping in the address translation table is intercepted, the virtual and physical addresses corresponding to the new mapping are checked by using the metadata, and a decision to create the new mapping is made if none of the virtual and physical addresses corresponding to the new mapping is provided with any other mapping in the address translation table. By so doing, it is possible to detect and prevent malicious attacks, such as those aimed at double mapping, on the address translation table.