PC-Based Memory Permission Tables for Fine-Grained Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processor address translation mechanisms provide coarse-grained permissions, leading to inefficiencies and security vulnerabilities due to the slow and synchronized nature of dynamically changing permissions, which are insufficient for modern software security models.
Innovation Solution
Implementing PC-based permission tables that utilize a primary and secondary permission table index to generate a combined index for fine-grained control of memory access and execution privileges, allowing different processes to have distinct permissions for the same memory address and enabling independent control of instruction subsets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If coarse-grained permissions are used in current processor address translation mechanisms, then device complexity is reduced and ease of operation is maintained, but manufacturing precision of permission control and reliability of security are worsened
Solution Approach 1:
The permission control mechanism is segmented into two independent tables: a first permission table storing base permissions for memory regions, and a second permission table storing permission adjustments indexed by program counter values. This segmentation allows fine-grained permission control without requiring a single complex permission table, thus improving manufacturing precision while managing device complexity through modular structure
Solution Approach 2:
The patent introduces a new dimension to permission control by adding program counter-based indexing as a secondary layer. Instead of only controlling permissions by memory region (single dimension), the system now controls permissions by combining memory region address with program counter address (two dimensions), enabling fine-grained control without proportionally increasing overall system complexity
2Adaptability or versatility
If dynamically changing permissions are implemented in current mechanisms, then adaptability to different software security models is improved, but speed of permission enforcement and productivity are worsened due to synchronized nature
Solution Approach 1:
Permissions are predetermined and stored in the permission tables before execution. The first permission table contains base permissions for different memory regions, and the second permission table contains program counter-specific adjustments. During execution, the processor simply performs table lookups using pre-computed indices, avoiding dynamic permission changes during runtime and maintaining high enforcement speed while supporting multiple security models
Solution Approach 2:
The patent creates a copied or replicated permission structure where permission information is stored in advance in table format. Instead of dynamically computing permissions during execution, the system copies permission definitions into the permission tables, allowing rapid retrieval through simple index-based lookup during program execution, thus maintaining speed while improving adaptability
3Reliability
If fine-grained permission control is implemented using PC-based permission tables, then reliability of security and manufacturing precision are improved, but device complexity increases due to dual table structure
Solution Approach 1:
The complex permission control task is segmented into two specialized tables: the first table handles memory region-based base permissions, while the second table handles program counter-based fine-grained adjustments. This segmentation improves security reliability by separating concerns, while managing complexity through clear division of functionality between the two tables rather than one monolithic complex table
Solution Approach 2:
The system merges the functionality of base permission control (first table) and fine-grained PC-based control (second table) into a unified permission enforcement mechanism. The processor combines information from both tables through index-based lookup and logical combination, achieving high security reliability while managing complexity by integrating the two tables into a coordinated system rather than separate independent mechanisms
Data Source
AI summary
A memory permissions model for a processor that is based on the memory address accessed by an instruction as well as the program counter of the instruction. These permissions may be stored in permissions tables and indexed using the memory addresses of the instruction and the address of the memory locations that it accesses. Those indexes may be obtained from a page table in some cases. These memory permissions may be used in conjunction with other permissions, such as execute permissions and secondary execution privileges that are based on whether the instruction belongs to a particular instruction group.