Peripheral Device Resource Isolation for Untrusted Hosts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Peripheral devices used for sensitive computations face security challenges due to the potential maliciousness of the host computing device, leading to resource misallocation and breaches, and existing solutions like static partitioning result in underutilization.
Innovation Solution
A peripheral device package with a command processor that enforces resource isolation using a hidden metadata structure, allowing dynamic allocation and ensuring secure execution even on untrusted hosts, by routing resource requests through a command processor that checks ownership and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static partitioning is used to isolate resources for secure computations, then security is improved, but resource utilization deteriorates
Solution Approach 1:
The patent implements dynamic resource allocation by introducing a command processor that receives resource allocation requests from multiple user runtime processes and dynamically assigns shared resources based on current needs and a data structure tracking resource ownership. This replaces static partitioning with a dynamic system that maintains security through enforced isolation while improving resource utilization by allowing flexible sharing when safe.
Solution Approach 2:
The command processor acts as an intermediary between user runtime processes and shared resources. It mediates resource allocation by checking the data structure to determine current ownership and making informed decisions about resource assignment. This intermediary layer maintains security constraints while enabling dynamic allocation, resolving the contradiction between security and utilization.
2Productivity
If peripheral devices are used for sensitive computations, then computation efficiency is improved, but security risks worsen due to potential host maliciousness
Solution Approach 1:
The command processor serves as a trusted intermediary between the potentially malicious host and the peripheral device resources. It enforces isolation policies by checking the data structure before allowing resource access, ensuring that even if the host is compromised, secure user runtime processes maintain their resource isolation. This enables efficient computation on peripheral devices while mitigating security risks.
Solution Approach 2:
The system implements feedback mechanisms where the command processor continuously monitors resource allocation requests against the data structure tracking current ownership. This feedback loop ensures that resource access decisions are made based on current system state, maintaining security constraints while enabling efficient computation when safe to do so.
3Reliability
If resource isolation is enforced for secure processes, then security is improved, but device complexity worsens
Solution Approach 1:
The command processor is introduced as a relatively simple intermediary component that handles the complexity of resource isolation enforcement. Rather than making the entire peripheral device complex, only the command processor is enhanced with isolation-checking logic. This localized complexity addition maintains security while minimizing overall device complexity impact.
Solution Approach 2:
The data structure is maintained within the peripheral device itself, enabling the command processor to autonomously make resource allocation decisions without requiring complex external verification. This self-service approach to tracking resource ownership simplifies the isolation enforcement mechanism while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A peripheral device package for use in a host computing device has a plurality of compute elements and a plurality of resources shared by the plurality of compute elements. A datastructure is stored in a hidden memory of the peripheral device package. The data structure holds metadata about ownership of resources of the peripheral device package by a plurality of user runtime processes of the host computing device which use the compute elements. At least one of the user runtime processes is a secure user runtime process. The peripheral device package has a command processor configured to use the datastructure to enforce isolation of the resources used by the secure user runtime process.