Secure Exception Handler Selection in Multi-Domain Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As data processing systems become more complex, ensuring the security of sensitive data within a secure domain from access by non-secure applications becomes increasingly difficult, particularly in systems where malicious programs aim to access secure data.
Innovation Solution
The implementation of a processor that operates in multiple modes and domains, with selective and dedicated exception handling mechanisms, allowing for flexible exception processing and secure data protection by distinguishing between secure and non-secure domains, and utilizing a monitor mode for secure data management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single exception handling mechanism is used in both secure and non-secure domains, then the system is simpler to implement, but security is compromised as malicious non-secure applications could access secure data through exception handlers
Solution Approach 1:
The exception handling mechanism is segmented into separate secure and non-secure exception handlers. When an exception occurs, the system determines whether it should be handled by a secure or non-secure handler based on the exception type and current security state, preventing unauthorized cross-domain access while maintaining appropriate exception processing functionality in each domain.
Solution Approach 2:
Different exception handlers are assigned different security properties and access rights according to their specific domain requirements. Secure exception handlers operate with secure access permissions while non-secure handlers operate with restricted permissions, ensuring each handler has the appropriate quality for its intended use case without unnecessary complexity.
2Adaptability or versatility
If exception handling is fully flexible and selectable, then adaptability to different operating systems is improved, but security control is weakened as it becomes difficult to enforce constrained responses
Solution Approach 1:
The exception handling system dynamically selects between secure and non-secure handlers based on runtime conditions including the type of exception and the current security state of the processor. This dynamic selection mechanism provides flexibility for different operating systems and exception scenarios while maintaining security control through enforced constraints on which handlers can be invoked under specific conditions.
Solution Approach 2:
The system changes the security state parameter of the processor to determine which exception handlers are accessible. By modifying the security state parameter, the system can enforce constrained responses to certain exceptions (such as watchdog security timer exceptions that must always use secure handlers) while allowing flexibility for other exception types.
3Ease of operation
If all exceptions can be handled by non-secure handlers, then ease of operation is improved, but security is compromised as secure data may be accessed through exception processing
Solution Approach 1:
The exception handling system is segmented into secure and non-secure domains with clear boundaries. Non-secure handlers can process common exceptions with simple operation, while secure handlers handle exceptions that require access to secure data, ensuring secure data protection is maintained through this segmentation.
Data Source
AI summary
An apparatus for processing data includes a processor operable in a plurality modes including at least one secure mode being a mode in a secure domain and at least one non-secure mode being a mode in a non-secure domain. When the processor is executing a program in a secure mode the program has access to secure data which is not accessible when the processor is operating in a non-secure mode. The processor is responsive to one or more exception conditions for triggering exception processing using an exception handler. The processor is operable to select the exception handler from among a plurality of possible exception handlers in dependence upon whether the processor is operating in the secure domain or the non-secure domain.