Microprocessor Cache Permission Bits for Hardware Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional microprocessors fail to balance hardware performance and operating system performance while inadequately supporting computer security, leading to optimizations that result in higher OS performance and low power requirements at the cost of increased hardware complexity.
Innovation Solution
A microprocessor computer system with a hardware subsystem featuring cache controller and cache bank modules that include hardware permission bits for managing access to system resources, combined with a computer security framework that enforces a hierarchy of access layers to provide hardware-level security primitives, isolating trusted and untrusted software and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware-level security mechanisms are implemented with permission bits and access layers, then computer security is improved, but device complexity increases
Solution Approach 1:
The system segments security control into multiple hierarchical access layers (first access layer for trusted OS, second access layer for less trusted software, third access layer for completely untrusted software). Each layer has distinct permission bit controls, dividing the security function into manageable segments that can be independently managed and enforced by hardware.
Solution Approach 2:
Different permission bits are assigned to different cache banks and memory regions based on their security requirements. The hardware permission bits provide localized security control at the cache bank level, allowing fine-grained access control where needed while maintaining simplicity in other areas of the system.
2Reliability
If hardware permission bits and access layers are implemented, then access control to system resources is improved, but hardware complexity increases
Solution Approach 1:
The access control mechanism is segmented into hardware-level permission bits stored in each cache bank, separate from software-based access control. This segmentation allows the hardware to enforce basic permission checks independently, while the operating system handles more complex access control policies, distributing the complexity across multiple levels.
Solution Approach 2:
The cache banks automatically enforce access control using their embedded hardware permission bits without requiring external intervention for each access check. The permission bits self-service the access control function by automatically blocking unauthorized access attempts at the hardware level, reducing the burden on the operating system and simplifying the overall control mechanism.
3Reliability
If security mechanisms are implemented in hardware, then security enforcement is improved, but manufacturing complexity increases
Solution Approach 1:
The security mechanism uses configurable permission bits that can be set to different values (allowed/not allowed) for different cache banks and access layers. This parameter-based approach allows the same hardware structure to be manufactured once and then configured for different security requirements through software initialization, avoiding the need for complex custom manufacturing for each security configuration.
4Reliability
If hardware-level security primitives are implemented, then security against hacking is improved, but hardware complexity increases
Solution Approach 1:
The hardware permission bits act as an intermediary security layer between the physical hardware and the software. This intermediary enforces security policies at the cache bank level, preventing direct unauthorized access to hardware resources while maintaining a relatively simple hardware structure that doesn't require complex security circuits.
Data Source
AI summary
A microprocessor computer system for secure/high assurance/safety critical computing includes a hardware subsystem having a plurality of cache controller and cache bank modules including cache bank and memory cell hardware permission bits for managing and controlling access to system resources. A computer security framework subsystem includes a hierarchy of access layers comprising top layers and lower layers. The permission bits provide hardware level computer security primitives for a computer operating system. The top layers are completely trusted and the lower layers are moderately trusted to completely untrusted. The top layers include a trusted operating system layer that executes management and control of the system resources and permission bits. The permission bits define limits for a hardware execution security mechanism for less trusted to completely untrusted software. Exceeding bounds of the security mechanism results in a hardware exception thereby blocking all attempts to access or modify resources outside the security mechanism.