Main Memory Tag Compression for Security Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional processor architectures face challenges in securing computer systems due to high overheads in enforcing security policies, which can be costly in terms of energy and performance, especially when using large metadata tags for hardware support.
Innovation Solution
Implementing main memory tag compression using short tags (e.g., 16-bit tags) that can be translated into full tags, allowing for adaptive encoding based on usage frequency to reduce energy consumption and memory requirements while maintaining effective security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pointer-sized (64-bit) tags are added to 64-bit words for hardware security policy enforcement, then security policy enforcement capability is improved, but main memory size requirement doubles
Solution Approach 1:
The patent segments the tag into two parts: a short tag (e.g., 16-bit) stored in main memory and a full tag (64-bit) stored in a tag map data structure. This segmentation allows the system to maintain security enforcement capability while reducing main memory overhead by only storing compressed short tags in the primary memory space.
Solution Approach 2:
The patent implements a nested structure where the short tag in main memory points to or indexes into a tag map data structure that contains the full tag. This nested arrangement enables the system to use minimal space in main memory while still having access to the complete tag information when needed for security policy enforcement.
2Reliability
If large metadata tags are used for hardware security support, then security enforcement accuracy is improved, but energy consumption increases
Solution Approach 1:
The patent applies local quality by using short tags in the frequently accessed main memory and only expanding to full tags when actually needed for security policy checks. This localized expansion minimizes the energy consumption associated with transferring and processing large tag data, while maintaining accurate security enforcement when required.
Solution Approach 2:
The patent performs preliminary compression of tags to short form before storing them in main memory. This preliminary action reduces the amount of data that needs to be moved and processed during normal operations, thereby reducing energy consumption while preserving the ability to perform accurate security checks when needed.
3Volume of stationary object
If short tags are used in main memory, then memory requirements are reduced, but tag information completeness is lost
Solution Approach 1:
The patent introduces a tag map data structure as an intermediary between the short tags in main memory and the full tags needed for security enforcement. The tag map acts as a mediator that translates the compressed short tags back into complete tag information when required, thus preserving tag information completeness while maintaining memory efficiency.
Solution Approach 2:
The patent moves the full tag information to a different dimension - the tag map data structure - rather than storing it directly in main memory alongside the short tags. This dimensional separation allows the system to maintain complete tag information availability while keeping main memory requirements low, as the tag map can be accessed on-demand rather than being permanently resident in main memory.
Data Source
AI summary
Methods, systems, and computer readable media for using metadata tag compression. A method occurs at a metadata processing system for enforcing security policies in a processor architecture. The method comprises: receiving, at the metadata processing system, a short tag associated with a word in memory; translating the short tag, using a tag map, into a long tag, wherein the short tag indicates a location of the long tag relative to an offset in the tag map and wherein the long tag indicates a memory location containing metadata associated with the word or an instruction; obtaining the metadata from the memory location; and determining, using the metadata, whether the word or the instruction violates a security policy.