Peripheral Device Data Protection Through Secure Abstraction Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Micro-architectural data sampling (MDS) vulnerabilities expose sensitive data to malicious actors who can infer secrets by collecting and analyzing data movements, especially in cloud environments, leading to potential data leaks and unauthorized access.
Innovation Solution
A system and method are implemented to create a protected execution zone across system memory and CPU cache, using secure virtual abstraction layers and volatile protected execution zones to limit access to sensitive data based on context-specific process identifiers, remapping memory and cache addresses to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure virtual abstraction layer is created to protect sensitive data, then data security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a secure virtual abstraction layer that acts as an intermediary between the CPU and peripheral devices. This layer includes virtual nodes that mediate data transactions, preventing direct access to sensitive data by malicious actors while maintaining system functionality. The abstraction layer translates and controls access requests, ensuring security without requiring fundamental changes to the existing system architecture.
2Reliability
If address space remapping is implemented to limit access, then unauthorized access is prevented, but access speed decreases
Solution Approach 1:
The patent implements address space remapping in advance by creating a firmware memory map driver before data transactions occur. The address spaces of peripheral devices are pre-configured to point to protected memory regions controlled by the secure virtual abstraction layer. This preliminary setup ensures that even if data is being actively processed, unauthorized access is already blocked, and authorized access paths are pre-established to minimize performance impact.
Data Source
AI summary
An information handling system creates a secure virtual abstraction layer for a data transaction of a peripheral device and creates a virtual node as a passthrough of the secure virtual abstraction layer for the data transaction. The information handling system also remaps an address space of the peripheral device to a pseudo driver space for the data transaction.