Memory Reference Object Indirection Enforcement via Hardware Counters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Graph data structures face limitations in implementing memory reference objects (MROs) with indirection enforcement, which affects data security and access control, particularly in pointer-heavy applications, as existing mechanisms cannot effectively limit the level of indirection and enforce secure navigation.
Innovation Solution
The implementation of indirection counters with each MRO to enforce a desired degree of indirection, allowing selective access control by determining the loadability of subsequent MROs and updating their counters, thereby prohibiting further loading when a threshold is reached, and providing hardware support through processor registers and an instruction set architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If capabilities with hardware-supported enforcement are used, then data security is improved, but the ability to enforce predetermined levels of indirection is lost
Solution Approach 1:
The capability structure is segmented into multiple fields including a base address, offset, permission bits, and a new indirection counter field. This segmentation allows the capability to independently track and enforce indirection levels while maintaining existing security features like capability erasure on copying or alteration.
Solution Approach 2:
The indirection counter acts as a parameter that changes with each level of indirection. When a capability is loaded, its indirection counter is decremented; when the counter reaches zero, further indirection is prohibited. This parameter-based approach enables hardware-enforced indirection control without compromising the fundamental security model.
2Adaptability or versatility
If indirection counters are added to each MRO, then indirection level control is improved, but device complexity increases
Solution Approach 1:
The indirection counter is merged with the existing capability structure rather than being a separate independent component. The counter is integrated into the capability registers and handled through existing CPU instruction set architecture, combining multiple functions (security enforcement, indirection tracking, access control) into a unified structure that minimizes additional complexity.
3Reliability
If capabilities are used for fine grain data protection, then data security is improved, but access to deeper graph structures becomes restricted
Solution Approach 1:
The indirection counter provides dynamic control over graph navigation depth. The counter is automatically decremented with each capability load, and the hardware automatically enforces the indirection limit. This dynamic mechanism allows flexible access control without requiring manual intervention or complex software policies, making the system both secure and easy to operate.
Data Source
AI summary
In one example in accordance with the present disclosure, enforcement of memory reference object loading indirection is described. According to a method, at a register, it is determined from an indirection counter of a first memory referencing object (MRO) in one of a number of registers of a processor of the computing device, whether a second MRO is loadable. When the indirection counter of the first MRO indicates a second MRO is loadable, the second MRO is loaded from the memory device to one of the number of registers. The second MRO also includes an indirection counter. The indirection counter of the loaded second MRO is changed, at the register that contains it, based on the indirection counter of the first MRO to enforce a degree of MRO loading indirection. Further, MRO loading is prohibited when an indirection counter reaches zero by invalidating a capability counter of a subsequent MRO at the register.