Memory Transfer Control via Proxy and Firewall Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory access control mechanisms, such as MMU and I/O-MMU, fail to securely manage data transfers during direct memory access (DMA) operations, where a component transfers data on behalf of another, lacking effective access control and security level enforcement.
Innovation Solution
A method and architecture that utilize initiator components, proxies, and firewalls with filtering policies to manage data transfers, ensuring secure access by determining the security levels of initiator components and proxies, and enforcing access rules through stateful and static firewalls to control and filter memory access requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DMA transfers are implemented without additional control mechanisms, then data transfer efficiency is improved, but security control capability deteriorates
Solution Approach 1:
The patent introduces a proxy as an intermediary component between the initiator and memory. The proxy receives transfer requests from initiators, determines the initiating component, and forwards requests to memory only after security verification. This intermediary structure enables DMA transfers to proceed efficiently while adding a layer of security control that verifies security levels without blocking the transfer path.
Solution Approach 2:
The patent segments the memory access control function into two distinct parts: a proxy that handles transfer request routing and initiator identification, and a memory-specific firewall that handles security level verification. This segmentation allows the DMA transfer path to remain efficient while distributing security control responsibilities to specialized components.
2Adaptability or versatility
If traditional MMU mechanisms are used for memory access control, then address translation is improved, but access control for third-party transfers deteriorates
Solution Approach 1:
The patent extends the MMU mechanism's functionality beyond address translation to include security verification. The memory-specific firewall uses the initiator identifier to retrieve security levels and verify access permissions, making the MMU-based system universal for both address management and security control. This multi-functionality eliminates the need for separate security control hardware while maintaining address translation capabilities.
Solution Approach 2:
The proxy acts as an intermediary that bridges the gap between traditional MMU address translation and new security requirements. It determines the initiating component from transfer requests and works with the memory-specific firewall to enforce access control policies, enabling third-party transfer security without compromising address translation functionality.
3Reliability
If security verification is performed for every transfer request, then security control capability is improved, but processing overhead increases
Solution Approach 1:
The system performs preliminary actions by having initiators register their security levels with the memory-specific firewall before actual transfers occur. The proxy also pre-determines the initiating component from transfer requests. This preliminary setup allows the firewall to quickly verify security levels during transfers without performing complex analysis in real-time, reducing processing overhead while maintaining strong security control.
Data Source
Figure 1
Figure 2
AI summary
The invention relates to a method for managing the transfer of data from or to at least one memory (14) of an architecture (12), the architecture (12) comprising: - initiator components (16) suitable for requesting the transfer of data from or to the memory (14), - proxies (18), and - firewalls (20), each memory (14) and each initiator component (16) having a security level, the architecture (12) being characterized by a filtering policy defining access rules to the memory (14) for each initiator component (16) and for each proxy (18) according to the security levels, the method comprising at least one reception step, one determination step, and one access authorization step.