Secure Shared Area for Module Execution Sequence Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In secure processors, it is challenging to ensure a fixed execution sequence of multiple modules running cooperatively, as existing verification methods cannot reliably prevent changes to the execution sequence by third parties, leading to potential attacks and sequence disruptions.
Innovation Solution
A computer program product that includes a shared memory area accessible only to cooperating modules, where each module stores and verifies its execution identifier before switching operations, ensuring that only authorized modules execute in the correct sequence by using a secure shared area and authentication key exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If modules run cooperatively in a secure processor with isolated contexts, then data security between modules is improved, but execution sequence control deteriorates
Solution Approach 1:
The patent introduces a shared area as an intermediary mechanism between isolated module contexts. This shared area allows modules to store and retrieve execution identifiers, enabling sequence verification while maintaining context isolation. The shared area acts as a mediator that facilitates controlled interaction without compromising security boundaries.
Solution Approach 2:
The patent implements a feedback mechanism where each module verifies the execution identifier stored in the shared area before executing. This verification process provides feedback on whether the current execution sequence is authorized, allowing modules to detect and prevent unauthorized sequence changes while maintaining their isolated contexts.
2Adaptability or versatility
If OS manages execution control of modules, then system flexibility is improved, but execution sequence security deteriorates
Solution Approach 1:
The patent segments execution control into two parts: the OS maintains general execution control for system flexibility, while individual modules perform specific verification of execution sequences using identifiers stored in the shared area. This segmentation allows the OS to remain flexible while modules enforce security requirements independently.
Solution Approach 2:
The patent implements preliminary action by having modules store their execution identifiers in the shared area before actual execution. This advance preparation allows the verification mechanism to check whether the current execution sequence is authorized, preventing unauthorized execution before it occurs.
3Reliability
If modules are encoded with different keys and isolated, then data protection is improved, but cooperative execution verification deteriorates
Solution Approach 1:
The patent uses copying by storing execution identifiers in the shared area that can be read by multiple modules. Instead of complex inter-module communication protocols, each module simply reads the identifier from the shared area, which is a copied representation of the execution state. This simplifies verification while maintaining security through the shared area's access control.
Data Source
AI summary
According to an embodiment, a computer program product includes a computer-readable medium including program, when executed by a computer, to have a plurality of modules run by the computer. The computer includes a memory having a shared area, which is an area accessible to only those modules which run cooperatively and storing therein execution module identifiers. Each of the modules includes a first operation configured to store, just prior to a switchover of operations to an other module that runs cooperatively, an identifier of the other module as the execution module identifier in the shared area; and a second operation configured to execute, when the execution module identifier stored in the shared area matches with an identifier of own module immediately after a switchover of operations from the other module, a function inside the own module.