Protection Unit for Non-Overlapping Memory Regions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data processing apparatuses with multiple processing units, ensuring data isolation between different processes while maintaining parallelism is challenging, as existing methods either compromise on performance or introduce security vulnerabilities.
Innovation Solution
A protection unit is implemented to control access to a shared storage unit by defining non-overlapping, contiguous access regions for each process, with region limits that can only be increased, ensuring secure and efficient data isolation between processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple processes are allowed to run concurrently on multiple processing units, then parallelism and productivity are improved, but data isolation and security between processes deteriorate
Solution Approach 1:
The storage unit is segmented into multiple isolated regions, with each region allocated to a specific process. The protection unit enforces these segment boundaries, allowing multiple processes to run concurrently on multiple processing units while ensuring that each process can only access its designated storage region, thus maintaining data isolation and security
Solution Approach 2:
A protection unit is introduced as an intermediary component between the processing units and the storage unit. This protection unit controls and monitors all access requests to the storage unit, verifying whether each request complies with the allocated access regions for different processes, thereby enabling secure concurrent access without requiring process cooperation
2Reliability
If separate storage units are provided for each process, then data isolation is improved, but device complexity and cost increase
Solution Approach 1:
Multiple storage regions that would traditionally require separate physical storage units are merged into a single shared storage unit. The protection unit logically partitions this shared storage unit into distinct regions for different processes, maintaining data isolation while reducing hardware complexity and cost associated with providing separate storage units for each process
3Device complexity
If reliance is placed on processes to behave well in accessing stored data, then device complexity is reduced, but security and reliability deteriorate
Solution Approach 1:
Access region boundaries for each process are predetermined and configured in advance within the protection unit, before any data access operations occur. This preliminary configuration of access permissions eliminates the need for complex runtime security checks or process behavior monitoring, achieving both low device complexity and high security through proactive access control
Data Source
AI summary
A data processing apparatus is provided, comprising plural processing units configured to execute plural processes, a storage unit configured to store data required for the plural processes; and a protection unit configured to control access by the plural processes to the storage unit. The protection unit is configured to define an allocated access region of the storage unit for each process of the plural processes, wherein the protection unit is configured to deny access for each the process outside the allocated access region and wherein allocated access regions are defined to be non-overlapping. The protection unit is configured to define each allocated access region as a contiguous portion of the storage unit between a lower region limit and an upper region limit, and the protection unit is configured such that when the lower region limit is modified the lower region limit cannot be decreased and such that when the upper region limit is modified the upper region limit cannot be decreased.