ORAN Shared Memory Isolation for Secure Network Slices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data center networks face security concerns due to shared resource access among multiple tenants, leading to potential unauthorized access and data breaches, especially in critical-use scenarios like public safety and healthcare.
Innovation Solution
Implementing a controlled shared memory (COSM) management system that enforces two-level isolation mechanisms, including host-level access control and data-level inspection, to segregate memory access among tenants, with features like self-destructive buffers to prevent data persistence and unauthorized retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If shared memory resources are used among multiple tenants, then resource utilization efficiency is improved, but security risks and unauthorized access increase
Solution Approach 1:
The patent implements memory segmentation by dividing the shared memory into isolated memory regions for different tenants. Each tenant is allocated dedicated memory regions that are logically separated, preventing cross-tenant access while maintaining efficient resource sharing. This segmentation approach resolves the contradiction by enabling secure multi-tenancy without compromising security.
Solution Approach 2:
The patent introduces a memory isolation mechanism as an intermediary layer between tenants and shared memory resources. This intermediary manages memory access rights, enforces isolation policies, and mediates communication between tenants, allowing efficient resource utilization while preventing unauthorized access and data breaches.
2Object-affected harmful factors
If strict memory isolation is implemented among tenants, then security is improved, but system complexity increases
Solution Approach 1:
The patent employs a nested memory isolation structure where isolation mechanisms are integrated within the existing memory management framework. The isolation layers are nested within the memory hierarchy, with hardware-level isolation supporting software-level isolation, enabling strong security without proportionally increasing system complexity.
Solution Approach 2:
The patent changes memory access parameters and attributes to enforce isolation policies. By modifying memory region attributes, access rights, and isolation levels, the system achieves secure tenant separation through parameter-based control rather than complex structural changes, thereby improving security without excessive complexity increase.
3Object-affected harmful factors
If memory regions are allocated exclusively to tenants, then data security is improved, but resource sharing capability deteriorates
Solution Approach 1:
The patent implements dynamic memory region allocation and isolation. Memory regions can be dynamically assigned to different tenants based on demand, and isolation levels can be adjusted at runtime. This dynamic approach enables exclusive allocation when security is critical while allowing flexible sharing when needed, resolving the contradiction between data security and resource sharing capability.
Solution Approach 2:
The patent applies different isolation qualities to different memory regions based on data sensitivity and tenant requirements. Critical data receives strict isolation, while less sensitive data can be shared. This local quality differentiation enables selective exclusivity, improving data security where needed while maintaining resource sharing capability where appropriate.
Data Source
AI summary
Examples described herein include shared reserved memory regions providing communications among network functions for isolation among network slices. In some examples, circuitry is configured to: based on receipt of a first request, allocate a first region of one or more memory regions of a memory to store data reserved for access by a first network function, wherein the first network function comprises an Open Radio Access Network (ORAN) Control Unit (CU) of a radio access network (RAN) and wherein an ORAN Distributed Unit (DU) is to provide the data and based on receipt of a second request, allocate a second region of one or more memory regions of the memory to store second data reserved for access by a second network function, wherein the second network function comprises a second ORAN CU of the RAN, the DU is to provide the second data, and the DU is shared among the first CU and the second CU.