Secure Program Context Restoration via Isolated Processor Core
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In heterogeneous processing environments, existing systems are vulnerable to security threats as malevolent users can circumvent security measures by capturing and reusing software images, leading to illegitimate software copies or 'replay attacks', which compromise the integrity and security of software programs.
Innovation Solution
A method and system that securely restore a program context by setting a special purpose processor core in isolation mode, accessing a shared memory, decrypting an encrypted context using an encryption key, and verifying context integrity using persistent security data, thereby preventing unauthorized access and ensuring the execution of the secured program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If program context is stored in shared memory for restoration, then productivity is improved through efficient task switching, but security deteriorates as malevolent users can capture and reuse software images
Solution Approach 1:
The patent applies preliminary anti-action by preemptively encrypting the program context with an encryption key before storing it in shared memory. This encryption prevents malevolent users from capturing and reusing the software images, as the encrypted context cannot be interpreted or executed without the corresponding decryption key. The encryption is performed before the potential security threat can materialize, thus neutralizing the replay attack vulnerability while maintaining efficient task switching.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of an encryption key and decryption process between the shared memory storage and program execution. Instead of directly storing and restoring plaintext context, the system uses encrypted context as an intermediary form. The special purpose processor core must obtain and apply the decryption key to restore the context, adding a security layer that prevents unauthorized reuse while allowing legitimate task switching.
2Adaptability or versatility
If special purpose processor core accesses shared memory for context restoration, then adaptability is improved through flexible thread loading, but security deteriorates due to potential unauthorized access
Solution Approach 1:
The patent applies preliminary anti-action by preemptively encrypting the program context with an encryption key before storing it in shared memory. This encryption prevents malevolent users from capturing and reusing the software images, as the encrypted context cannot be interpreted or executed without the corresponding decryption key. The encryption is performed before the potential security threat can materialize, thus neutralizing the replay attack vulnerability while maintaining efficient task switching.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of an encryption key and decryption process between the shared memory storage and program execution. Instead of directly storing and restoring plaintext context, the system uses encrypted context as an intermediary form. The special purpose processor core must obtain and apply the decryption key to restore the context, adding a security layer that prevents unauthorized reuse while allowing legitimate task switching.
3Reliability
If encryption is applied to program context, then security is improved against replay attacks, but device complexity increases due to key management requirements
Solution Approach 1:
The patent applies self-service by having the special purpose processor core autonomously manage its own encryption and decryption operations. The processor core independently handles the cryptographic operations to encrypt context before storage and decrypt context during restoration, without requiring external security management infrastructure. This self-service approach enhances security while minimizing the added complexity by distributing the cryptographic burden to the executing processor itself.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for securely restoring software program context is presented. A special purpose processor core is included in a heterogeneous processing environment where each processor can access a shared memory. The isolated special purpose processor core includes an isolated local memory. The isolated special purpose processor core receives an identifier corresponding to the secured program. The identifier is used to read an encrypted context of the secured program from the shared memory. The encrypted context is decrypted using an encryption key. The decrypted context is stored in the isolated special purpose processor core's local memory. The secured program's context integrity is verified by using a persistent security data that is retrieved from a secure location, such as a persistent storage register that can only be accessed when the special purpose processor core is running in isolation mode. If the context is verified, the secured program is executed.