Secure Memory Partitioning for Open and Secure Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to effectively partition secure data and operations from unauthorized access in open and secure processor environments, posing security risks in complex embedded and portable computer systems.
Innovation Solution
A method and system for generating secure partition regions by using a partition generator to create secure and system memory regions, controlled by system and secure partition registers, ensuring secure operations are isolated from unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional systems are used to store and manage sensitive information, then system flexibility and open application operation are maintained, but security protection against unauthorized access is insufficient
Solution Approach 1:
The system is divided into distinct secure and non-secure partition regions within the same address space. The partition generator creates separate regions with different access permissions, allowing sensitive information to be isolated in secure regions while maintaining open access to non-secure regions. This segmentation enables security protection without requiring completely separate physical systems.
Solution Approach 2:
Different regions of the address space are assigned different security properties. Secure partition regions have restricted access permissions while non-secure regions have open access. This local differentiation of quality allows the system to maintain flexibility in non-secure areas while providing strong security where needed.
2Reliability
If secure partition regions are generated to protect sensitive information, then unauthorized access is prevented, but system complexity increases
Solution Approach 1:
The partition generator creates secure partition regions in advance during system initialization or compilation, before actual data processing occurs. By pre-establishing the partition structure and access permissions, the system avoids the complexity of dynamic partition management during runtime while maintaining strong security controls.
Solution Approach 2:
The partition generator automatically analyzes application code and data requirements to create appropriate secure partitions without requiring manual configuration. The system self-determines which regions need security protection and generates the corresponding partition structure autonomously, reducing the complexity burden on system designers.
3Adaptability or versatility
If secure and non-secure operations share the same processor, then system flexibility is maintained, but security risks increase from potential unauthorized access
Solution Approach 1:
The system adds a security dimension to the traditional processor architecture by introducing partition regions with different access permissions within the same address space. This dimensional addition allows secure and non-secure operations to coexist on the same processor without interference, maintaining flexibility while eliminating unauthorized access risks through spatial separation in the address space.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example implementations includes a method of partitioning a non-transitory memory device by detecting a boot state of a processing device including a non-transitory memory device, identifying a startup state of the processing device based on the boot state, and partitioning the memory device into at least one secure address region, in accordance with a determination that the startup state satisfies an operating state condition. Example implementations also include a method of generating a secure partition associated with a non-transitory memory device by identifying a target processing instruction restricted to execution at a secure subsystem of a processing device, assigning to the target processing instruction a secure address, associating the secure address with a secure address region of a non-transitory memory device of the processing device, and generating a secure partition table including the secure address.