Realm-Aware Memory Isolation via Identifier Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current memory isolation techniques in computing systems, such as virtual machines and trusted execution environments, do not adequately protect software programs from unauthorized access and observation, leading to potential security compromises.
Innovation Solution
Implementing a realm-aware processor and memory controller system that tags memory access requests with a realm identifier, ensuring that only authorized memory access is permitted by matching the request's realm identifier with the allocated memory space, thereby preventing cross-realm access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional memory isolation techniques (virtual machines, trusted execution environments) are used, then software programs can execute with some level of protection, but memory space is not sufficiently isolated from unauthorized accesses by other software programs
Solution Approach 1:
The patent divides memory space into distinct realms, each with its own isolation domain. The memory management unit segments address spaces into multiple isolated realms, ensuring that software programs in one realm cannot access memory spaces in other realms. This segmentation approach directly addresses the insufficient isolation problem by creating hard boundaries between different software execution environments.
Solution Approach 2:
The patent introduces a memory management unit as an intermediary between the processor and memory space. This intermediary enforces realm-based access control by intercepting memory access requests, verifying the realm identifier, and allowing or blocking access based on whether the request originates from an authorized realm. This mediator prevents unauthorized access without requiring changes to the software programs themselves.
2Reliability
If memory access control is enforced to prevent unauthorized access, then security is improved, but system complexity increases due to additional isolation mechanisms
Solution Approach 1:
The patent integrates realm-based isolation mechanisms into existing memory management infrastructure, making the memory management unit perform multiple functions: traditional address translation, cache management, and now realm-based access control. By making the memory management unit universal and multi-functional, the patent avoids adding separate complex isolation hardware while still achieving strong security guarantees.
Solution Approach 2:
The patent combines realm identification and access control enforcement with the existing memory management unit functionality. Instead of creating separate isolation hardware, the realm checking logic is merged into the memory management unit's address translation and access control paths. This merging reduces overall system complexity by consolidating functions rather than adding redundant components.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A method is described. The method includes executing a memory access instruction for a software process or thread. The method includes creating a memory access request for the memory access instruction having a physical memory address and a first identifier of a realm that the software process or thread execute from. The method includes receiving the memory access request and determining a second identifier of a realm from the physical memory address. The method also includes servicing the memory access request because the first identifier matches the second identifier.