Memory Protection via Read-Write Control Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The x86 architecture lacks a mechanism for both read and write protection of memory regions, making it possible for malicious programs to circumvent write protection by creating alias page tables, thereby compromising the security of operating systems and resources.
Innovation Solution
A method and apparatus that utilize super-privileged code to identify and protect specific memory regions by indicating them as read and write disabled, ensuring only authorized programs can access these regions by determining their access authority through a read/write protection table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If write protection is implemented using page tables, then write access to protected memory regions is prevented, but read access can still be circumvented by creating alias page tables
Solution Approach 1:
The patent segments the access control mechanism into two independent tables: a read access control table and a write access control table. Each table independently manages its specific access type, preventing circumvention through alias page table creation. The read access control table stores read access rights for memory regions, while the write access control table stores write access rights, creating a divided security architecture that addresses the vulnerability in unified page table-based protection.
Solution Approach 2:
The patent introduces an intermediary access control mechanism between the CPU and memory regions. Instead of relying solely on page table mappings, the system uses intermediate access control tables that verify read and write permissions separately. This intermediary layer checks access requests against the respective control tables before allowing memory access, blocking unauthorized reads even when write protection is in place and alias page tables are created.
2Adaptability or versatility
If privilege levels are used to control access, then hierarchical access control is provided, but fine-grained read/write protection of specific memory regions is not available
Solution Approach 1:
The patent applies local quality by providing customized read and write access permissions for specific memory regions rather than applying uniform privilege level restrictions across all memory. Each memory region can have independent read access control and write access control settings stored in respective control tables, allowing fine-grained control where different parts of memory have different access requirements tailored to their specific security needs.
Solution Approach 2:
The patent segments the monolithic privilege level access control into region-specific read and write control tables. Instead of relying on the coarse-grained x86 privilege levels (0-3) that apply system-wide, the invention creates fine-grained control tables that manage access permissions at the memory region level, enabling precise control over which programs can read or write to specific memory areas regardless of their privilege level.
3Ease of operation
If operating systems operate at privilege level zero, then full access to system resources is granted, but security vulnerabilities and malicious attacks increase
Solution Approach 1:
The patent implements preliminary anti-action by pre-establishing read and write access control tables that define authorized access to memory regions before any program execution occurs. These control tables are populated with authorized program identifiers and memory region permissions in advance, creating a security framework that proactively blocks unauthorized access attempts. When programs operate at privilege level zero, the access control tables already contain the necessary restrictions to prevent them from accessing unauthorized memory regions, countering potential security defects and malicious attacks before they can occur.
Solution Approach 2:
The patent introduces an intermediary access control layer between privilege level zero programs and system resources. The read access control table and write access control table act as intermediaries that filter and control all memory access requests from high-privilege programs. Even though privilege level zero programs have full theoretical access to resources, the intermediary control tables verify each access request against predefined permissions, blocking harmful factors while allowing legitimate resource access.
Data Source
AI summary
The present invention provides a method and apparatus for securing portions of a memory. The method includes identifying information for protection and indicating at least one physical address of a memory that houses the information as at least one of read and write disabled. The method includes receiving a request from a program to access the information. The method further includes accessing the information in response to determining that the program has the authority to access the information. The apparatus includes a memory comprising a privileged code. The privileged code is capable of receiving a request to protect selected information and indicating at least one physical address of a memory housing the information as at least one of read and write disabled. The privileged code is capable of receiving a request from a program to access the information. The privileged code is further capable of accessing the information in response to determining that the program has the authority to access the information.