Processor Memory Access Control via Capability Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing architectures that utilize non-volatile memory, unauthorized access by malicious programs or improperly configured processors can lead to impaired system performance, failed boot states, and security vulnerabilities due to uncontrolled access to memory devices.
Innovation Solution
Implementing a memory access control mechanism where the processor securely identifies the capabilities of a memory device through data packets, cross-checks these against predefined policies, and limits access to prevent unauthorized configurations, ensuring only authorized access to volatile or non-volatile memory modes based on processor capabilities and configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the processor allows unrestricted access to memory devices, then system performance and adaptability are improved, but security vulnerabilities and system reliability deteriorate due to unauthorized access by malicious programs or improperly configured processors
Solution Approach 1:
The system performs preliminary identification of processor capabilities and memory device capabilities before allowing access. The processor identifies its own capabilities (such as volatile memory access, non-volatile memory access, PCI-e read/write permissions) and the memory device identifies its capabilities (such as 3D crosspoint technology type, operational modes) during initialization. This preliminary identification establishes a foundation for subsequent policy-based access control, preventing unauthorized access before it can occur while still allowing legitimate access patterns.
Solution Approach 2:
The system implements a policy manager that receives feedback about processor capabilities and memory device capabilities, then generates appropriate access policies. The policy manager continuously monitors the system state and adjusts access permissions based on the identified capabilities and current policies. This feedback mechanism ensures that access control decisions are based on up-to-date information about system capabilities and security requirements.
2Reliability
If the processor implements capability identification and policy-based access control, then system security and reliability are improved, but device complexity and processing overhead increase
Solution Approach 1:
The processor and memory device perform self-identification of their own capabilities without requiring external verification. The processor identifies its own capabilities (volatile memory access, non-volatile memory access, PCI-e permissions) and the memory device identifies its own capabilities (3D crosspoint technology, operational modes) autonomously during initialization. This self-service approach reduces the complexity of the access control mechanism by eliminating the need for complex external verification procedures while maintaining security.
Solution Approach 2:
The policy manager serves multiple functions: it receives capability information from the processor and memory device, generates access policies based on this information, and enforces these policies during operation. This multi-functional approach consolidates what could be separate complex systems into a single policy manager component, reducing overall system complexity while maintaining comprehensive access control.
3Reliability
If the processor limits access to memory devices based on capability comparison, then system security is improved, but system performance and productivity may deteriorate due to restricted memory operations
Solution Approach 1:
The system establishes access policies during initialization before normal operation begins. The processor identifies its capabilities, the memory device identifies its capabilities, and the policy manager generates appropriate policies in advance. This preliminary action ensures that during actual memory operations, the processor can access permitted memory regions without real-time policy evaluation overhead, maintaining high performance while still enforcing security constraints.
Solution Approach 2:
The policy manager acts as an intermediary that translates capability comparisons into concrete access policies. Instead of performing complex capability comparisons during every memory access operation, the policy manager pre-processes this information and creates simplified access rules. This intermediary approach separates the complex policy generation phase from the performance-critical memory access phase, maintaining both security and performance.
Data Source
AI summary
Systems, apparatuses and methods may provide for technology that conducts a comparison between an identified capability of a memory device and memory usage rules associated with a processor. The memory usage rules are to identify allowed memory accesses by the processor. The technology further limits access by the processor to the memory device based upon the comparison.