Pointer-Embedded Memory Safety Tags for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security methods for memory storage are inefficient due to high overhead costs, complexity, and power consumption, particularly in addressing buffer overflows, use-after-free attacks, and return-oriented programming attacks, and current error correction codes lack sufficient granularity and are susceptible to abuse.
Innovation Solution
A system that uses a pointer with an address and a memory security tag to encrypt and decrypt data, reducing the need for additional storage space and processing overhead, employing a tweakable block cipher with a memory safety tag to secure data without modifying the storage device's size or increasing power consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If tags are stored with data in memory to secure data, then data security is improved, but memory size and power consumption increase
Solution Approach 1:
The patent extracts the security tag from the memory storage space and places it in the pointer structure instead. This separation allows the tag to be stored with the pointer in registers or cache rather than in the memory array itself, thereby securing data without increasing memory size.
Solution Approach 2:
The pointer is given multiple functions: it not only stores the address of the data but also contains the security tag. This multi-functionality eliminates the need for separate storage space for the tag in memory, as the pointer structure serves both addressing and security purposes.
2Reliability
If tags are stored with data in memory to secure data, then data security is improved, but processing overhead increases
Solution Approach 1:
The patent merges the security tag with the pointer structure, combining what were previously separate entities (pointer and tag) into a single integrated data structure. This reduces the number of separate operations needed to manage and verify security tags.
Solution Approach 2:
The pointer structure itself carries the security tag information needed for verification. When data is accessed, the pointer already contains the tag, eliminating the need for separate tag retrieval and management operations, thereby reducing processing overhead.
3Reliability
If error correction codes are used to secure data, then data integrity is improved, but the granularity is coarse and bits may be insufficient
Solution Approach 1:
The patent changes the parameter of security verification from coarse-grained ECC bits to fine-grained security tags associated with specific data pointers. This allows security to be applied at the level of individual data structures rather than large memory blocks, providing the necessary granularity for precise security control.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A chip for securing storage of information includes a manager to access a pointer and a cipher engine to decrypt stored data. The pointer includes a first area and a second area. The first area includes an address indicating a storage location of the data and the second area includes a safety tag. The cipher engine decrypts the data output from the storage location based on a key and the safety tag in the second area of the pointer. These and other operations may be performed based on metadata that indicate probabilities that a correct safety tag was used to decrypt the data. In another embodiment, the manager may be replaced with an L1 cache.