Physical Address Permissions Table for Secure DMA Access

Solution Overview

Problem

Existing systems face challenges in ensuring secure memory access, particularly in scenarios where endpoints may attempt unauthorized access to physical addresses, especially in environments with multiple Virtual Machines (VMs) and Trusted Execution Environments (TEEs), where unauthorized access cannot be reliably prevented.

Innovation Solution

Implementing a physical address access permissions table (PAAPT) to verify the authorization of entities requesting memory access, by recording permissions for entities and physical addresses, and using these tables to authorize or deny access based on recorded permissions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If Address Translation Services (ATS) are enabled to allow endpoints to perform Direct Memory-Access (DMA) transfers using cached physical addresses, then memory access latency is reduced and translation agent burden is decreased, but the risk of unauthorized memory access increases

Engineering Contradiction:

Improvememory access latencyVSAvoidmemory access security

Core Design Contradiction:

SpeedVSReliability

Solution Approach 1:

The system performs preliminary address translation and permission recording before DMA transfers occur. The translation agent translates virtual addresses to physical addresses and records the corresponding permissions in a permissions table in advance. When DMA transfers occur, the endpoint can directly use cached physical addresses without real-time translation, while the pre-recorded permissions ensure security validation is already in place.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a permissions table as an intermediary structure between the translation agent and memory access. This table stores the relationship between physical addresses and authorized endpoints, acting as a mediator that validates whether an endpoint is authorized to access a specific physical address during DMA transfers, thus decoupling the speed benefit from the security risk.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If ATS is disabled to prevent unauthorized memory access, then memory access security is maintained, but memory access latency increases and translation agent burden increases

Engineering Contradiction:

Improvememory access securityVSAvoidmemory access latency

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The system performs preliminary address translation and permission recording before DMA transfers occur. The translation agent translates virtual addresses to physical addresses and records the corresponding permissions in a permissions table in advance. When DMA transfers occur, the endpoint can directly use cached physical addresses without real-time translation, while the pre-recorded permissions ensure security validation is already in place.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces a permissions table as an intermediary structure between the translation agent and memory access. This table stores the relationship between physical addresses and authorized endpoints, acting as a mediator that validates whether an endpoint is authorized to access a specific physical address during DMA transfers, thus decoupling the speed benefit from the security risk.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If multiple Virtual Machines (VMs) share a host with different Trusted Execution Environment (TEE) configurations, then system versatility and resource utilization improve, but the ability to guarantee endpoint access authorization deteriorates

Engineering Contradiction:

Improvemulti-VM supportVSAvoidendpoint access authorization

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the permissions table by VM identifier, creating separate permission sets for each virtual machine. Each VM has its own namespace of authorized physical addresses and endpoints. This segmentation allows the system to maintain multiple VMs with different TEE configurations while ensuring that endpoint authorization is validated within the correct VM context, preventing cross-VM unauthorized access.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system applies local quality by associating specific permission records with specific VM instances. Each entry in the permissions table is tagged with a VM identifier, allowing the system to enforce different access policies for different VMs. This enables versatile multi-VM support while maintaining strict authorization control within each local VM context.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS12481602B2Preventing unauthorized memory access using a physical address access permissions table

Publication Date: 2025.11.25 NVIDIA CORP

AI summary

A host may use address translation to convert virtual addresses to physical addresses for endpoints, which may then submit memory access requests for physical addresses. The host may record permissions granting entities access to physical addresses in physical address access permissions tables (PAAPTs) responsive to the address translation. The security of address translation services may be increased based at least on verifying memory access requests are authorized using the PAAPTs. For example, an entity identifier included in a request may be used to locate a corresponding PAAPT, and a physical address may be extracted from the request and used to locate an entry indicating whether an entity corresponding to the entity identifier has permission to access the physical address. Where the entity has permission, the system may perform the memory access using the physical address. Otherwise an error or fault code may be provided in response to the request.