Secure Memory Validation in Heterogeneous Multi-Core Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Heterogeneous multi-core embedded systems face challenges in ensuring data security when using different processing units, as existing security measures struggle to maintain stability and security during data processing between various processing devices.
Innovation Solution
An electronic device is designed with a first control module comprising a normal module and a security module, where the normal module sets a secure memory area and the security module determines its validity, allowing secure data processing by requesting the second control module to process data and providing control signals based on the processing results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If different kinds of processing devices are used to improve task efficiency, then processing speed and productivity are improved, but data security and system reliability deteriorate
Solution Approach 1:
The system divides processing devices into two distinct segments: a first control module (CPU) for general control and security-critical operations, and a second control module (GPU) for parallel processing of non-critical tasks. This segmentation allows each module to operate with appropriate security measures, maintaining data security while improving overall processing productivity through specialized division of labor.
Solution Approach 2:
A memory management unit (MMU) acts as an intermediary between the first and second control modules, controlling memory access and enforcing security policies. The MMU validates memory addresses and prevents unauthorized access to secure memory regions, enabling the second module to process data efficiently while the intermediary ensures data security is maintained throughout the system.
2Reliability
If security is set on a specific processor or memory area, then data security is improved, but device complexity and operational difficulty increase
Solution Approach 1:
The memory management unit (MMU) serves multiple functions simultaneously: it manages memory allocation, controls access permissions, validates addresses, and enforces security policies across different memory regions. This multi-functionality consolidates security mechanisms into a single universal component, reducing overall system complexity while maintaining comprehensive data security protection.
Solution Approach 2:
The system performs preliminary security configuration by designating specific memory regions as secure before data processing begins. The first control module pre-configures memory access permissions and security attributes, so that subsequent data processing by the second module automatically inherits these security protections without requiring complex real-time security decisions, thereby simplifying operational complexity.
3Reliability
If secure memory is set and validity is determined, then data security is improved, but processing time and operational complexity increase
Solution Approach 1:
The first control module performs preliminary validation of secure memory regions during system initialization or before data transfer, determining the validity and security attributes of memory areas in advance. This preliminary action ensures that when the second module processes data, security validation has already been completed, minimizing additional processing time while maintaining rigorous security checks.
Solution Approach 2:
The memory management unit implements a feedback mechanism where security validation results are cached and reused for subsequent access requests to the same memory regions. Once a memory region's security status is validated, this information is fed back into the system for rapid verification of future accesses, reducing redundant validation operations and minimizing processing time delays.
Data Source
AI summary
An electronic device is provided. The electronic device includes a first control module including a normal module and a security module, and a second control module distinct from the first control module. The normal module sets a secure memory which the security module and the second control module access, and the security module determines validity of the set secure memory.