Memory Protected-Region Management with Device-Level Access Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems lack effective mechanisms to prevent unauthorized access to protected regions, particularly in scenarios involving multiple virtual machines sharing a memory resource, leading to potential security breaches.
Innovation Solution
Implementing security measures at the memory device level by verifying access commands with credentials and keys, segregating protected regions among virtual machines, and enhancing security modes to mitigate unauthorized access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple virtual machines share a memory resource, then memory utilization and productivity are improved, but security and reliability deteriorate due to potential unauthorized access between VMs
Solution Approach 1:
The patent divides the shared memory resource into multiple protected regions, with each region assigned to a specific virtual machine. This segmentation is implemented through region tags stored in memory metadata that identify which VM can access which memory region. The segmentation resolves the contradiction by allowing multiple VMs to share the physical memory resource while maintaining logical isolation, thus preserving both productivity (through sharing) and security (through isolation).
Solution Approach 2:
The patent introduces an intermediary security mechanism at the memory device level that mediates access requests between virtual machines and memory regions. This intermediary checks region tags and access credentials before permitting memory operations, acting as a gatekeeper that enables shared access while preventing unauthorized cross-VM access. This intermediary layer resolves the security concern without compromising the benefits of memory sharing.
2Reliability
If security measures are implemented at the memory device level with key verification, then security and reliability are improved, but device complexity increases
Solution Approach 1:
The patent implements self-service security where the memory device autonomously verifies access credentials and region tags without requiring external security management. The memory device itself performs the security checks using stored region information and access credentials, eliminating the need for complex external security infrastructure. This self-service approach improves security while minimizing the increase in device complexity by leveraging existing memory management capabilities.
Solution Approach 2:
The patent performs preliminary security setup by pre-configuring region tags and access credentials in the memory device before virtual machines attempt to access memory regions. This preliminary action establishes security boundaries in advance, allowing the memory device to automatically enforce access control without real-time complex decision-making. The pre-configured security parameters simplify the access control logic during operation, resolving the complexity issue.
3Reliability
If protected regions are segregated among virtual machines with region tags, then security is improved, but ease of operation deteriorates due to additional access verification steps
Solution Approach 1:
The patent extracts the security verification logic from the application layer and embeds it directly in the memory device's hardware or firmware. This extraction means that security checks are performed automatically as part of the memory access operation itself, rather than requiring separate verification steps in the software. The region tags are checked automatically during memory operations, maintaining ease of operation while ensuring security.
Data Source
AI summary
Apparatuses and methods related to managing regions of memory are described. Managing regions can include verifying whether an access command is authorized to access a particular region of a memory array, which may have some regions that have rules or restrictions governing access (e.g., so-called “protected regions”). The authorization can be verified utilizing a key and a memory address corresponding to the access command. If an access command is authorized to access a region, then a row of the memory array corresponding to the access command can be activated. If an access command is not authorized to access the region, then a row of the memory array corresponding to the access command may not be activated.