Least Privileged OS Virtual Memory Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Typical computer operating systems have unrestricted access to all information and resources, leading to instability and potential crashes if an entry point is compromised, as they access unnecessary data.
Innovation Solution
Implementing a least privileged principle where a processor uses different encryption schemes for software code and entry point data in virtual memory, allowing access only to necessary data, with a memory management unit mapping and unmapping areas as needed, and an encryption module assigning unique encryption keys to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the operating system has access to all information and resources at all times, then the system can handle any operation, but the system becomes vulnerable to crashes and security compromises when an entry point is compromised
Solution Approach 1:
The patent divides the operating system into multiple isolated segments or compartments, each with its own virtual memory space and encryption scheme. This segmentation prevents a compromise in one entry point from affecting other segments, thereby maintaining system stability while preserving full operational capability through controlled access to each segment.
Solution Approach 2:
The patent applies different encryption schemes to different portions of the operating system based on their specific security requirements and access needs. Each segment receives tailored encryption protection rather than a uniform approach, allowing the system to maintain versatility while enhancing reliability through localized security measures.
2Productivity
If the operating system accesses all data continuously, then all operations can be performed, but unnecessary data access increases security risks and system vulnerability
Solution Approach 1:
The patent implements dynamic memory mapping where virtual memory segments are mapped to physical memory only when needed and unmappped when not needed. This dynamic approach allows the operating system to maintain high productivity by accessing data only when required, while simultaneously reducing security vulnerabilities by limiting continuous exposure of data to potential attacks.
3Reliability
If encryption schemes are applied to virtual memory mapping, then security is enhanced, but system complexity increases
Solution Approach 1:
The patent introduces a memory management unit as an intermediary layer between the operating system and physical memory. This mediator handles the complexity of multiple encryption schemes and virtual memory mapping automatically, providing enhanced security while shielding the operating system from the underlying complexity through a standardized interface.
Data Source
AI summary
A method and system encrypts data in a least privileged operating system. The method includes determining a first encryption scheme to be used with software code to be mapped to a virtual memory. The method includes mapping a first portion of the virtual memory with the software code for access by a processor using the first encryption scheme. The method includes receiving a call for an entry point of the operating system. The method includes determining a second encryption scheme to be used with the entry point when mapped to the virtual memory. The method includes mapping a second portion of the virtual memory for executing entry point code associated with the entry point for access by the processor using the second encryption scheme. The processor executing the software code is permitted to access only data from the first and second portions of the virtual memory.