Hardware-Enforced Memory Access Permissions via MMU
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security techniques in information processing systems are ineffective in preventing malware from corrupting memory access permissions, as malware can exploit bugs and buffer overflows to circumvent access controls.
Innovation Solution
Implementing hardware-enforced memory access permissions through a memory management unit (MMU) that uses a permissions map to translate linear addresses to physical addresses and enforce access restrictions, preventing unauthorized access and detecting potential violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based access permissions are used in data structures, then memory access control is implemented, but malware can corrupt these data structures to circumvent access permissions
Solution Approach 1:
A hardware-based permission enforcement mechanism is introduced as an intermediary between the memory management unit and the data structures. This hardware component validates access permissions independently of the software data structures, preventing malware from circumventing access controls by corrupting software-based permission data.
2Reliability
If hardware-enforced permission validation is implemented, then malware corruption is prevented, but system complexity increases
Solution Approach 1:
The memory management unit is enhanced to perform self-validation of access permissions through hardware-based checks. The system serves itself by automatically validating permissions at the hardware level without requiring additional complex software validation layers, reducing overall system complexity while maintaining strong security.
Data Source
AI summary
Embodiments of apparatuses and methods for hardware enforced memory access permissions are disclosed. In one embodiment, a processor includes address translation hardware and memory access hardware. The address translation hardware is to support translation of a first address, used by software to access a memory, to a second address, used by the processor to access the memory. The memory access hardware is to detect an access permission violation.