NVM Protection System for Malicious Applet Isolation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing protective mechanisms for non-volatile memory (NVM) in mobile devices are inadequate in detecting and preventing malicious applets from compromising data security through uncontrolled read/write operations.

Innovation Solution

A protection system for NVM that includes a processing unit monitoring applets in real-time, establishing predefined policies for NVM usage, and providing a virtual environment to prevent uncontrolled access by malicious applets, thereby ensuring secure NVM operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If wear leveling mechanisms are implemented in NVM systems, then the longevity and reliability of memory blocks are improved, but the system complexity increases due to the need for monitoring and managing wear counters across multiple memory blocks

Engineering Contradiction:
ImproveNVM block longevityVSAvoidwear counter management system
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The NVM system is divided into multiple wear domains, each with its own wear counter. This segmentation allows the system to track wear at a manageable scope (per domain rather than per individual block), reducing the overall complexity while maintaining reliability through targeted wear leveling management.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

A wear domain is introduced as an intermediary layer between individual NVM blocks and the wear leveling controller. The wear domain aggregates multiple blocks and maintains a single wear counter that represents the collective wear state, simplifying the management overhead while still enabling effective wear leveling across the underlying blocks.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If real-time monitoring of applets is implemented to detect malicious activities, then data security is improved, but the processing overhead and system resource consumption increase

Engineering Contradiction:
Improvedata securityVSAvoidprocessing unit energy consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

Security policies are established and configured in advance before applet execution begins. The processing unit loads these pre-defined security rules into a dedicated security module, which then automatically enforces them during runtime without requiring complex real-time analysis, thereby reducing processing overhead and energy consumption while maintaining strong security.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

A dedicated security module is introduced as an intermediary between the processing unit and applets. This specialized module handles security monitoring and policy enforcement separately from the main processing workload, isolating the security functions to reduce the energy burden on the general-purpose processing unit while maintaining continuous security oversight.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If a virtual environment is provided to prevent uncontrolled read/write access, then NVM protection is improved, but the system complexity increases due to additional access control mechanisms

Engineering Contradiction:
ImproveNVM protectionVSAvoidaccess control system
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The security system applies different access control policies to different applets based on their specific requirements and trust levels. Instead of a uniform complex access control mechanism for all applets, the system tailors security measures locally to each applet's needs, providing strong protection where necessary while allowing simpler access for trusted applications, thereby reducing overall system complexity.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The virtual environment and access control mechanisms are dynamically adjusted based on the applet's behavior and security policy violations. The system can adaptively change the level of monitoring and restriction applied to different applets at different times, rather than maintaining a static complex access control structure for all scenarios, thus reducing the effective complexity while maintaining robust protection.

Inventive Principle:
Principle #15Dynamics

Data Source

PatentEP4571547A1A protection system for a non-volatile memory (NVM) and a method thereof
Publication Date: 2025.06.18 GIESECKE DEVRIENT MOBILE SECURITY GERMANY GMBH
  • EP4571547A1 patent drawingFigure 1
  • EP4571547A1 patent drawingFigure 2
  • EP4571547A1 patent drawingFigure 3~4

AI summary

The present disclosure relates to a protection system (106) for a non-volatile memory (NVM). The system (106) monitors one or more applets (110) at run time associated with an NVM read/write operation. The system (106) establishes a predefined policy associated with an NVM usage for said at least one applet among the one or more applets (110) for performing the read/write operation. The system (106) compares the NVM usage by said at least one applet among the one or more applets (110) with the predefined policy. The system (106) determines if said at least one applet among the one or more applets (110) is violating the predefined policy. The system (106), in response to a positive determination, provides a virtual environment at run time to prevent said at least one applet among the one or more applets (110) from an uncontrolled read/write access and provides the protection for the NVM.