Processor Secure Mode DMA Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Processing systems used over networks or as shared resources face security challenges due to potential hacking and access to malicious or obsolete data, which limits data storage space and reliability.
Innovation Solution
A method involving a processor entering secure mode, using direct memory access (DMA) commands with authorization codes to access trusted data storage regions, and establishing virtual private networks (VPNs) for encrypted data transfers to ensure secure and reliable data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented to restrict external access to the processor, then security and data reliability are improved, but the amount of accessible data storage space is severely limited
Solution Approach 1:
The data storage system is segmented into multiple regions with different security characteristics. Trusted data storage regions are separated from untrusted regions, allowing the processor to access secure data while maintaining the ability to access larger amounts of data in untrusted regions when security restrictions are not required. This segmentation resolves the contradiction by providing both secure access (improving reliability) and access to larger storage spaces (improving volume) through region-specific access control.
Solution Approach 2:
Different security measures and access controls are applied to different regions of the data storage system. The trusted data storage regions have strict security controls that ensure data reliability, while other regions may have more permissive access policies that allow larger storage capacity. This local differentiation allows the system to simultaneously achieve high reliability in critical areas and large overall storage capacity.
2Reliability
If the processor operates in secure mode with restricted external access, then security is improved, but data processing efficiency and speed are reduced
Solution Approach 1:
The processor's security mode is made dynamic rather than static. The processor can switch between secure mode and normal mode depending on the specific data access requirements. When accessing trusted data storage regions, the processor operates in secure mode with full security protections. When accessing untrusted regions or performing operations that don't require strict security, the processor can operate in normal mode with higher processing efficiency. This dynamic switching resolves the contradiction between security and processing speed.
Solution Approach 2:
A memory flow controller acts as an intermediary between the processor and the data storage regions. This intermediary manages the security protocols and authorization code verification, offloading the security management burden from the processor itself. The memory flow controller handles the complex security checks while allowing the processor to focus on data processing, thus maintaining both security and processing efficiency.
3Reliability
If authorization codes and security protocols are implemented for data access, then security is improved, but device complexity increases
Solution Approach 1:
The memory flow controller serves as an intermediary that encapsulates the complexity of security management. It handles authorization code verification, DMA command validation, and security protocol enforcement, shielding the processor from the complexity of these security mechanisms. The processor simply issues DMA commands to trusted regions, while the memory flow controller manages the security overhead, thus improving security without proportionally increasing processor complexity.
Solution Approach 2:
The trusted data storage regions are designed to self-verify authorization codes through hardware-based validation mechanisms. When a DMA command is issued with an authorization code, the trusted region automatically verifies the code's validity without requiring complex software-based authentication. This self-service approach to security verification simplifies the overall system architecture by reducing the need for complex external security management infrastructure.
Data Source
AI summary
A system and method are disclosed which may include entering a secure mode by a processor, whereby the processor may initiate a transfer of information into or out of the processor, but no external device may initiate a transfer of information into or out of the processor; sending a DMA (direct memory access) command including at least one authorization code from the processor to at least one trusted data storage region external to the processor; evaluating the authorization code; and enabling the processor to access at least one trusted data storage location within the trusted data storage region if the authorization code is valid.