Multi-Ring Shared Database for Secure Kernel-User Memory Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems face bottlenecks and security concerns when sharing information between trusted kernel mode and untrusted user mode using I/O request packets or memory sharing, which is insecure and does not allow for dynamic or easily traversable structured data.
Innovation Solution
A multi-ring shared, traversable, and dynamic database is used to synchronize and persist memory information across multiple protection modes, enabling secure and dynamic sharing of memory between kernel and user modes, with a shared heap and event processor for memory allocation and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If I/O request packets (IRPs) are used to share information between kernel mode and user mode, then information sharing is enabled, but application performance bottlenecks occur
Solution Approach 1:
The patent introduces a shared memory database as an intermediary structure between kernel mode and user mode processes. This database serves as a mediator that enables direct information exchange without requiring traditional IRP mechanisms, thereby eliminating the performance bottlenecks associated with IRP-based communication while maintaining secure information sharing capabilities across protection rings.
Solution Approach 2:
The patent implements a shared memory database that creates copies of data structures in a protected shared region accessible by both kernel and user modes. By copying necessary data into this shared database rather than using IRP-based passing, the system enables efficient direct access to information while maintaining isolation and security boundaries between different protection modes.
2Reliability
If memory sections are shared between kernel mode and user mode, then information sharing is enabled, but security vulnerabilities are introduced
Solution Approach 1:
The patent segments the shared memory into multiple protection rings or access levels, where different portions of the shared database have different access permissions. This segmentation allows kernel mode and user mode processes to share information while maintaining strict security boundaries, preventing unauthorized access or corruption of critical data structures.
Solution Approach 2:
The patent applies different access control qualities to different regions of the shared memory database. Critical system data structures have restricted access limited to kernel mode, while application data can be accessed by both modes with appropriate permissions. This local quality differentiation enables secure information sharing by tailoring access rights to the specific security requirements of each data region.
3Reliability
If traditional memory sharing is used, then information exchange is enabled, but dynamic and traversable structured data access is not allowed
Solution Approach 1:
The patent implements a dynamic shared memory database where data structures can be modified, expanded, and reorganized during runtime. The database supports dynamic allocation and deallocation of memory regions, allows structures to grow or shrink based on application needs, and enables flexible traversal of data elements. This dynamic nature contrasts with traditional static memory sharing mechanisms and enables versatile structured data access patterns.
Data Source
AI summary
Examples of the present disclosure describe systems and methods for sharing memory using a multi-ring shared, traversable and dynamic database. In aspects, the database may be synchronized and shared between multiple processes and/or operation mode protection rings of a system. The database may also be persisted to enable the management of information between hardware reboots and application sessions. The information stored in the database may be view independent, traversable, and resizable from various component views of the database. In some aspects, an event processor is additionally described. The event processor may use the database to allocate memory chunks of a shared heap to components/processes in one or more protection modes of the operating system.