Protected Memory Access Instructions for Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face security vulnerabilities due to potential erroneous or malicious changes in page table data, which can lead to inappropriate sharing of private memory regions containing sensitive data, despite the use of memory management units and protection units.
Innovation Solution
The introduction of protected and less-protected memory access instructions with distinct encodings, where protected instructions enforce more restrictive access conditions and less-protected instructions allow for less restrictive access, helping to prevent accidental or malicious data sharing by ensuring appropriate access control based on shared/private flags and encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory management units are programmed with permission data to control memory accesses, then memory protection is improved, but security vulnerabilities remain due to erroneous or malicious changes in page table data
Solution Approach 1:
The instruction set is segmented into two distinct types: protected memory access instructions and less-protected memory access instructions. This segmentation allows the system to differentiate between operations that require strict security enforcement and those that can tolerate more permissive access conditions, thereby addressing the security vulnerability while maintaining necessary memory protection functionality.
Solution Approach 2:
Different security protection levels are applied to different memory access operations based on their specific requirements. Protected instructions enforce strict permission checks and prevent access to shared memory regions, while less-protected instructions allow more flexible access. This local quality approach ensures that security measures are applied precisely where needed without unnecessarily restricting legitimate memory operations.
2Object-affected harmful factors
If protected memory access instructions enforce restrictive access conditions, then data security is improved, but instruction set complexity increases
Solution Approach 1:
The security enforcement logic is extracted from the general memory access path and specifically integrated into the protected memory access instruction execution flow. This extraction allows the decoder to identify protected instructions and route them through enhanced security checks, while less-protected instructions follow the standard memory access path, thereby managing complexity by isolating security-critical operations.
Solution Approach 2:
The decoder performs preliminary identification of protected memory access instructions by examining specific encoding bits before the memory access operation is executed. This preliminary action allows the system to prepare appropriate security enforcement measures in advance, ensuring that protected instructions receive the necessary security treatment without adding significant overhead to the instruction execution pipeline.
3Ease of operation
If all memory access instructions use the same encoding format, then instruction decoding is simplified, but security differentiation between protected and less-protected operations cannot be achieved
Solution Approach 1:
The encoding formats for protected and less-protected memory access instructions are made asymmetric by utilizing different values for specific encoding bits. This asymmetry enables the decoder to easily distinguish between the two instruction types through simple bit comparison, maintaining decoding simplicity while achieving reliable security differentiation. The asymmetric encoding ensures that protected instructions can be identified and handled with appropriate security measures.
Data Source
AI summary
Processing circuitry performs processing operations specified by program instructions, and a decoder decodes memory access instructions to generate control signals to control the processing circuitry to perform memory access operations. The memory access instructions have respective encodings specifying protected memory access instructions corresponding to protected memory access operations and less-protected memory access instructions corresponding to less-protected memory access operations. The less-protected memory access operations are associated with less restrictive memory access conditions than the protected memory access operations.