Multi-Stage Address Translation with Forbidden Memory Mappings

Solution Overview

Problem

Conventional memory access control methods require significant computational resources and data storage for managing allowed mappings, especially when the number of protected addresses is small relative to the physical address space, leading to inefficiencies in memory management.

Innovation Solution

Implementing a forbidden mapping scheme that stores and searches through fewer mappings for virtual addresses by focusing on prohibited access regions, allowing for reduced memory usage and computational time by using a multi-stage address translation process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional allow-listed mapping schemes are used to perform memory access control, then security and proper execution of applications are ensured, but significant computational resources and data storage are required, especially when the number of protected addresses is small relative to the physical address space

Engineering Contradiction:

Improvememory access controlVSAvoiddata storage

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent inverts the conventional allow-listed approach by implementing a deny-listed mapping scheme. Instead of storing mappings for all permitted virtual addresses to physical addresses, the system stores mappings only for forbidden addresses. This inversion dramatically reduces the quantity of mapping data that must be stored and searched, especially when protected regions are small relative to the total address space.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent extracts only the essential security-critical information (forbidden mappings) from the complete address space, rather than managing all permitted mappings. By taking out only the relevant forbidden entries and storing them in a specialized fast-lookup structure, the system achieves efficient memory access control without the overhead of storing and searching through all possible permitted mappings.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If conventional allow-listed mapping schemes are used to perform memory access control, then security and proper execution of applications are ensured, but computational time increases due to searching through numerous mappings

Engineering Contradiction:

Improvememory access controlVSAvoidcomputational time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent inverts the conventional allow-listed approach by implementing a deny-listed mapping scheme. Instead of storing mappings for all permitted virtual addresses to physical addresses, the system stores mappings only for forbidden addresses. This inversion dramatically reduces the quantity of mapping data that must be stored and searched, especially when protected regions are small relative to the total address space.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent applies partial action by storing and searching only through the subset of mappings that are necessary for security (forbidden mappings) rather than all possible mappings. This selective approach reduces the search space and computational time while maintaining adequate security coverage.

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If allow-listed mappings are used for virtual addresses to physical addresses, then memory access control is performed, but the number of stored mappings increases when protected addresses are small relative to the physical address space

Engineering Contradiction:

Improvememory access controlVSAvoidmapping management

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent inverts the conventional allow-listed approach by implementing a deny-listed mapping scheme. Instead of storing mappings for all permitted virtual addresses to physical addresses, the system stores mappings only for forbidden addresses. This inversion dramatically reduces the quantity of mapping data that must be stored and searched, especially when protected regions are small relative to the total address space.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent applies local quality by creating a specialized fast-lookup structure for forbidden mappings that is optimized for the specific security requirements, rather than using a uniform mapping structure for all addresses. This allows the system to handle forbidden mappings efficiently without the overhead of managing the complete address space uniformly.

Inventive Principle:

Principle #3Local quality

Data Source

PatentEP4625185A1Memory access control with a forbidden mapping scheme

Publication Date: 2025.10.01 GOOGLE LLC

Figure 1
Figure 2A
Figure 2B

AI summary

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing memory access control using a forbidden mapping scheme. In to one aspect, a system comprises a memory management unit configured (i) to perform a multi-stage address translation, wherein a first stage of the address translation performs address translation from virtual addresses to intermediate physical addresses, and wherein a second stage of the address translation performs address translation from intermediate physical addresses to physical addresses, (ii) to maintain a forbidden mapping between intermediate physical addresses and physical addresses, and (iii) operate in a forbidden mapping mode to perform multi-stage address translation by performing operations comprising: translating a virtual address into an intermediate physical address, reading the forbidden mapping using the intermediate physical address, and returning a physical address for the intermediate physical address if the intermediate physical address misses in the forbidden mapping.