Secure Mode Controller for Context Switching in Processors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems-on-chip (SoC) face challenges in securely transitioning between user and secure modes without modifying the processor, as existing protection states are insufficient for security requirements, and the memory management unit and translation tables are considered non-secured resources.
Innovation Solution
A method and apparatus for controlling context switching between user and secure modes by monitoring the memory management unit for secure mode entry instructions, verifying their execution, and enabling mode transitions using a secure mode controller with an address tracking unit and secure state machine, while managing cache access based on secure and non-secure cache lines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the processor is an industry standard design with existing protection states, then binary compatibility and programmer's model are maintained, but security requirements are insufficient
Solution Approach 1:
A secure mode controller is introduced as an intermediary component between the processor and memory system. This controller includes an address tracking unit that monitors memory management unit operations and a secure state machine that manages transitions between user and secure modes. The intermediary enforces security policies without requiring modifications to the standard processor architecture, thereby maintaining binary compatibility while enhancing security control.
2Reliability
If the memory management unit and translation tables are considered non-secured resources, then address translation functionality is maintained, but they become potential security vulnerabilities
Solution Approach 1:
The secure mode controller performs preliminary monitoring of the memory management unit's address translation operations. Before allowing access to secure memory regions, the address tracking unit verifies that the translation is authorized by checking against the secure state machine's current mode state. This preliminary security check prevents unauthorized access while maintaining the normal address translation functionality of the memory management unit.
Solution Approach 2:
The secure mode controller implements a feedback mechanism where the address tracking unit continuously monitors memory management unit operations and reports back to the secure state machine. The state machine uses this feedback to determine whether to permit or block access to secure resources. This closed-loop control ensures that the memory management unit operates within security boundaries without requiring direct modification of its internal structure.
3Ease of operation
If context switching between user and secure modes is enabled, then secure resource accessibility is improved, but risk of unauthorized mode transition increases
Solution Approach 1:
The secure mode controller acts as an intermediary gatekeeper for mode transitions. When the processor attempts to switch between user and secure modes, the controller's address tracking unit intercepts the transition request and verifies it against security policies enforced by the state machine. Only authorized transitions are permitted, balancing ease of operation with security requirements.
Solution Approach 2:
The patent replaces traditional mechanical or hardware-based mode switching mechanisms with a software-controlled state machine approach. The secure state machine uses software-defined security policies to control mode transitions, allowing flexible and secure context switching without requiring complex hardware modification. This substitution enables secure mode switching while maintaining processor architecture compatibility.
Data Source
AI summary
A method and a secure mode controller are provided for controlling context switching between secure and user modes in a processing system including a processor and a memory management unit. The method comprises monitoring the memory management unit to detect a non-cache access to an entry point address that contains a secure mode entry instruction, verifying, in response to detection of the entry point address, that the secure mode entry point instruction is executed by the processor, and enabling context switching from the user mode to the secure mode in response to verifying that the secure mode entry instruction is executed by the processor. Each cache line of an instruction cache and a data cache may have a tag containing a secure bit to identify a secure cache line or a non-secure cache line.