Secure Memory Translation via Cryptographic Address Signing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data processing systems with multiple processing devices, caching translations between virtual and physical addresses can act as a bottleneck, as it may invalidate useful entries for one device when updating another, and there is a risk of unauthorized access to memory areas without a centralized security mechanism.
Innovation Solution
An apparatus with translation request, signing, and gateway circuitry that generates and validates cryptographic signatures for memory addresses, allowing each peripheral to store its own translations while preventing unauthorized access by using a private key to ensure validity and invalidate signatures when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a centralized translation cache is used, then translation lookup speed is improved, but system security deteriorates due to inability to prevent unauthorized access
Solution Approach 1:
The patent introduces a gateway as an intermediary component between the translation cache and memory access. The gateway validates translation requests by checking signatures generated by signing circuitry, acting as a security mediator that allows fast cached translations while preventing unauthorized access through cryptographic verification
2Speed
If each device is provided with its own cache, then translation lookup speed is improved, but device complexity increases and security management becomes more difficult
Solution Approach 1:
The patent segments the translation cache into device-specific portions, allowing each peripheral to have its own cached translations. This segmentation improves lookup speed for each device while the centralized signing and validation mechanism manages the complexity, balancing performance and manageability
Data Source
AI summary
An apparatus is provided, connectable to a memory and one or more peripherals. The apparatus includes translation request circuitry to receive a translation request from one of the peripherals to translate an input address within an input domain to an output address within an output domain. Signing circuitry generates a signature of at least part of the output address using a private key. Translation response circuitry responds to the translation request by transmitting to the one of the peripherals a translation response, including the output address and the signature. Gateway circuitry receives access requests to the memory. Each of the access requests comprises a desired memory address in the output domain and a signature of the desired memory address. The gateway performs validation of the signature of the desired memory address using the private key and in response to the validation of a given access request failing, performs an error action.