Secure Mode Page Table Data Segmentation in Memory Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems with secure and non-secure modes face security vulnerabilities due to unauthorized alterations of secure mode page table data, which can lead to unintended access to non-secure regions of memory, and the large memory capacity required to store this data is inefficient given the small amount of sensitive data.
Innovation Solution
Storing only the portion of secure mode page table data used for secure regions within secure memory and the portion used for non-secure regions within non-secure memory, with each page table entry containing a table security field to indicate storage location, allowing memory control circuitry to manage access and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all secure mode page table data is stored within secure regions of memory, then security is improved by protecting from unauthorized alteration, but memory capacity consumption increases disadvantageously
Solution Approach 1:
The patent divides secure mode page table data into two segments: secure page table data (for secure regions) and non-secure page table data (for non-secure regions). Each segment is stored in appropriate memory regions - secure data in secure memory and non-secure data in non-secure memory. This segmentation allows the system to maintain security for critical data while avoiding the need to store all page table data in secure memory, thus resolving the contradiction between security and memory capacity consumption.
2Quantity of substance
If secure mode page table data is stored in non-secure regions, then memory capacity is optimized, but security is compromised due to unauthorized alteration risk
Solution Approach 1:
The patent applies local quality by assigning different security attributes to different portions of page table data. Secure page table data that controls access to secure regions is stored in secure memory with high security protection, while non-secure page table data that controls access to non-secure regions is stored in non-secure memory. This localized security approach ensures that only the necessary data receives high-level protection, optimizing both security and memory capacity usage.
3Reliability
If secure memory region size is increased to store all page table data, then security protection is maintained, but available storage for sensitive data decreases
Solution Approach 1:
By segmenting page table data into secure and non-secure portions and storing them in separate memory regions, the patent reduces the size of secure memory required. This frees up secure memory capacity that can then be allocated for storing actual sensitive data such as encryption keys and financial information, thus resolving the contradiction between security protection and available storage for sensitive data.
Data Source
Figure 1
Figure 2~4
Figure 3
AI summary
Apparatus for data processing (2) is provided with processing circuitry (8) which operates in one or more secure modes (40) and one or more non-secure modes (42). When operating in a non-secure mode, one or more regions of the memory are inaccessible. A memory management unit (24) is responsive to page table data to manage accesses to the memory which includes a secure memory (22) and a non-secure memory (6). Secure mode page table data (36, 38) is used when operating in one of the secure modes. A page table entry within the hierarchy of page tables of the secure mode page table data includes a table security field (68, 72) indicating whether or not a further page table pointed to by that page table entry is stored within the secure memory (22) or the non-secure memory (6). If any of the page tables associated with a memory access are stored within the non-secure memory (6), then the memory access is marked with a table attribute bit NST indicating that the memory access should be treated as non-secure.