Protected Container Memory Secure I/O Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processor architectures do not enable secure communication between protected container memory and input/output devices, making secure data exchange between these components vulnerable to inspection and tampering.
Innovation Solution
The implementation of a protected container architecture with access control logic that allows secure direct memory access (DMA) and memory-mapped I/O (MMIO) operations between protected container modules and I/O devices, using mechanisms like Intel Software Guard Extensions (SGX) to ensure secure communication through encrypted and authenticated data paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional processor architectures are used for data exchange between memory and I/O devices, then communication simplicity is maintained, but security against inspection and tampering is compromised
Solution Approach 1:
The patent segments the memory space into protected container memory regions that are isolated from standard I/O access paths. This segmentation creates distinct security zones where sensitive data can be stored and accessed only through controlled, encrypted interfaces, thereby improving security without requiring complete architectural redesign.
Solution Approach 2:
The patent introduces encrypted communication interfaces as intermediaries between protected container memory and I/O devices. These intermediaries establish secure data paths that prevent inspection and tampering while maintaining the functional ability of I/O devices to access protected data through cryptographic protection mechanisms.
2Reliability
If protected container architecture with encrypted paths is implemented, then data confidentiality and integrity are improved, but communication overhead and processing complexity increase
Solution Approach 1:
The patent implements preliminary encryption and authentication setup during system initialization or container creation. Security parameters, encryption keys, and access controls are pre-configured, allowing encrypted communication to proceed with minimal real-time overhead once the protected paths are established.
Solution Approach 2:
The protected container architecture implements self-managing security mechanisms where the system automatically handles encryption, authentication, and access control without requiring extensive manual configuration or intervention. This reduces operational complexity while maintaining strong security protections.
Data Source
AI summary
An integrated circuit includes protected container access control logic to perform a set of access control checks and to determine whether to allow a device protected container module (DPCM) and an input and/or output (I/O) device to communicate securely through one of direct memory access (DMA) and memory-mapped input/output (MMIO). The DPCM and the I/O device are allowed to communicate securely if it is determined that at least the DPCM and the I/O device are mapped to one another, an access address associated with the communication resolves into a protected container memory, and a page of the protected container memory into which the access address resolves allows for the aforementioned one of DMA and MMIO. In some cases, a Security Attributes of Initiator (SAI) or security identifier may be used to obtain a DPCM identifier or attest that access is from a DPCM mapped to the I/O device. In some cases, a determination may be made that a type of access is compatible with one or more allowed access types for the page as represented in a protected container page metadata structure.