NVM Protection System for Malicious Applet Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing protective mechanisms for non-volatile memory (NVM) in mobile devices are inadequate in detecting and preventing malicious applets from compromising data security through uncontrolled read/write operations.
Innovation Solution
A protection system for NVM that includes a processing unit monitoring applets in real-time, establishing predefined policies for NVM usage, and providing a virtual environment to prevent uncontrolled access by malicious applets, thereby ensuring secure NVM operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If wear leveling mechanisms are implemented in NVM systems, then the longevity and reliability of memory blocks are improved, but the system complexity increases due to the need for monitoring and managing wear counters across multiple memory blocks
Solution Approach 1:
The NVM system is divided into multiple wear domains, each with its own wear counter. This segmentation allows the system to track wear at a manageable scope (per domain rather than per individual block), reducing the overall complexity while maintaining reliability through targeted wear leveling management.
Solution Approach 2:
A wear domain is introduced as an intermediary layer between individual NVM blocks and the wear leveling controller. The wear domain aggregates multiple blocks and maintains a single wear counter that represents the collective wear state, simplifying the management overhead while still enabling effective wear leveling across the underlying blocks.
2Reliability
If real-time monitoring of applets is implemented to detect malicious activities, then data security is improved, but the processing overhead and system resource consumption increase
Solution Approach 1:
Security policies are established and configured in advance before applet execution begins. The processing unit loads these pre-defined security rules into a dedicated security module, which then automatically enforces them during runtime without requiring complex real-time analysis, thereby reducing processing overhead and energy consumption while maintaining strong security.
Solution Approach 2:
A dedicated security module is introduced as an intermediary between the processing unit and applets. This specialized module handles security monitoring and policy enforcement separately from the main processing workload, isolating the security functions to reduce the energy burden on the general-purpose processing unit while maintaining continuous security oversight.
3Reliability
If a virtual environment is provided to prevent uncontrolled read/write access, then NVM protection is improved, but the system complexity increases due to additional access control mechanisms
Solution Approach 1:
The security system applies different access control policies to different applets based on their specific requirements and trust levels. Instead of a uniform complex access control mechanism for all applets, the system tailors security measures locally to each applet's needs, providing strong protection where necessary while allowing simpler access for trusted applications, thereby reducing overall system complexity.
Solution Approach 2:
The virtual environment and access control mechanisms are dynamically adjusted based on the applet's behavior and security policy violations. The system can adaptively change the level of monitoring and restriction applied to different applets at different times, rather than maintaining a static complex access control structure for all scenarios, thus reducing the effective complexity while maintaining robust protection.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
The present disclosure relates to a protection system (106) for a non-volatile memory (NVM). The system (106) monitors one or more applets (110) at run time associated with an NVM read/write operation. The system (106) establishes a predefined policy associated with an NVM usage for said at least one applet among the one or more applets (110) for performing the read/write operation. The system (106) compares the NVM usage by said at least one applet among the one or more applets (110) with the predefined policy. The system (106) determines if said at least one applet among the one or more applets (110) is violating the predefined policy. The system (106), in response to a positive determination, provides a virtual environment at run time to prevent said at least one applet among the one or more applets (110) from an uncontrolled read/write access and provides the protection for the NVM.