Protected Memory Region Access Control Using Device-Level Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory systems lack robust mechanisms to prevent unauthorized access to protected regions, relying solely on host-level security which can be inadequate.
Innovation Solution
Implementing security measures within the memory device itself by verifying access commands with credentials and keys, segregating protected regions among virtual machines, and responding to unauthorized access attempts with heightened security modes or device shutdown.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security measures are implemented at the host level only, then device complexity is reduced, but memory security is insufficient
Solution Approach 1:
The patent introduces an intermediary security mechanism at the memory device level that acts as a mediator between the host and memory cells. This intermediary layer verifies access credentials and enforces security policies independently, enhancing security without requiring complete redesign of the host system. The memory device itself becomes the intermediary that enforces protection keys and access controls.
Solution Approach 2:
The patent segments memory into protected regions with distinct access controls and protection keys. Each protected region can have independent security credentials, allowing fine-grained security management. This segmentation enables different security policies to be applied to different memory regions without affecting the entire memory system.
2Reliability
If multiple protected regions are managed for virtual machines, then memory isolation is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal protection key mechanism that can be applied across multiple protected regions and virtual machines. The same security infrastructure and verification process is used for all protected regions, regardless of which virtual machine is accessing them. This multi-functional approach allows a single security mechanism to handle isolation for multiple VMs simultaneously.
Solution Approach 2:
The patent uses copy-on-write technology where protected region descriptors and access credentials are copied and associated with different virtual machines. Each VM receives a copy of the necessary security credentials for accessing protected regions, enabling independent access control without duplicating the entire security infrastructure for each VM.
3Reliability
If access verification is performed at every memory access, then security is strengthened, but processing speed decreases
Solution Approach 1:
The patent performs preliminary verification by establishing protection keys and access credentials before actual memory access operations. The security credentials are pre-configured and associated with protected regions and virtual machines in advance. This preliminary setup allows for faster access during actual memory operations since the verification logic is already in place.
Solution Approach 2:
The patent replaces complex sequential verification mechanisms with more efficient hardware-based verification logic. The protection key comparison and access control decisions are implemented using optimized hardware circuits that can verify credentials in parallel, substituting mechanical/software-based verification with faster hardware-based mechanisms.
Data Source
Figure 1A
Figure 1B~2
Figure 3
AI summary
Apparatuses and methods related to managing regions of memory are described. Managing regions can include verifying whether an access command is authorized to access a particular region of a memory array, which may have some regions that have rules or restrictions governing access (e.g., so-called "protected regions"). The authorization can be verified utilizing a key and a memory address corresponding to the access command. If an access command is authorized to access a region, then a row of the memory array corresponding to the access command can be activated. If an access command is not authorized to access the region, then a row of the memory array corresponding to the access command may not be activated.