Memory Section Attribute Storage for Secure Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory access methods in computer systems are inefficient in handling non-consecutive memory locations and lack effective security policies for memory segments, leading to potential access violations.
Innovation Solution
A Memory Section Attribute Storage (MSAS) and Memory Access Control (MAC) circuit are implemented to manage memory sections with integer power of two sizes, using base addresses and security policies, enabling efficient segmentation and access control by comparing reduced address bits and applying security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional memory access methods are used, then memory locations can be accessed, but access to non-consecutive memory locations is inefficient and lacks security policies
Solution Approach 1:
The memory space is divided into multiple memory sections, each with its own base address and size attributes stored in the MSAS. This segmentation allows independent security policies to be applied to different memory regions, improving both access efficiency for non-consecutive locations and security enforcement through section-specific policies.
Solution Approach 2:
A Memory Section Attribute Storage (MSAS) structure is introduced as an intermediary between the memory controller and the memory array. The MSAS stores section attributes (base addresses, sizes) and security policies, acting as a mediator that translates memory access requests into section-specific operations with proper security checks.
2Reliability
If memory segmentation is implemented without optimization, then security policies can be applied, but address comparison complexity increases
Solution Approach 1:
The invention changes the parameter representation by storing only base addresses and sizes for each memory section in the MSAS, rather than maintaining complete address ranges. This parameter optimization reduces the complexity of address comparison operations while still enabling effective security policy enforcement through section identification.
3Reliability
If comprehensive security policies are applied to all memory sections, then access security is improved, but access overhead increases
Solution Approach 1:
Security policies are pre-configured in the MSAS for each memory section during system initialization or memory mapping operations. This preliminary action allows the memory access controller to perform quick lookups of pre-established security policies during runtime, reducing access overhead while maintaining comprehensive security coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus includes a memory, a Memory Section Attribute Storage (MSAS) and a memory access circuit (MAC). The memory includes a plurality of memory sections. The MSAS includes one or more entries, wherein at least some of the entries specify, for respective sections of the memory, respective section security policies, respective section base addresses and respective section sizes. The MAC is configured to receive, from a host, a memory access request that specifies an address to be accessed in the memory, to identify a target memory section that corresponds to the address, responsively to the section base addresses and to the section sizes specified in the MSAS, to receive, from the MSAS, a security policy that corresponds to the target memory section, and to apply the security policy to the memory access request.