Shared Memory Access Control via Secured Address Range Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualization environments, shared memory devices are vulnerable to unauthorized access and data compromise due to lack of real-time monitoring and control, leading to potential data leaks and operational inefficiencies.
Innovation Solution
Implement a management entity that registers memory address ranges for each abstracted resource in a secured portion of the memory device, verifying access requests to ensure only authorized access to the memory device, thereby preventing unauthorized access and optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time monitoring and control over memory device access is implemented for each abstracted resource, then security against unauthorized access is improved, but device complexity and resource overhead increase
Solution Approach 1:
The patent introduces a management entity as an intermediary between abstracted resources and the memory device. This entity maintains a memory device address table that maps logical addresses to physical addresses and controls all access requests. By placing this intermediary layer, the system achieves centralized security control without requiring each abstracted resource to implement its own monitoring mechanisms, thus improving security while managing complexity through abstraction.
Solution Approach 2:
The management entity serves multiple functions: it acts as a security controller, an address translator, and an access arbitrator. By consolidating these functions into a single entity rather than distributing them across multiple components, the system reduces overall device complexity while maintaining comprehensive security control over memory access by multiple abstracted resources.
2Reliability
If continuous monitoring is performed by each abstracted resource to prevent unauthorized access, then data protection is improved, but computing resource efficiency deteriorates
Solution Approach 1:
The management entity operates autonomously to handle all access control decisions. It automatically verifies access requests against the memory device address table and grants or denies access without requiring active monitoring or intervention from individual abstracted resources. This self-service approach eliminates the need for each resource to consume computing resources on continuous monitoring, thereby improving overall resource efficiency while maintaining data protection.
3Measurement precision
If individual monitoring is implemented by each abstracted resource, then access control precision is improved, but resource allocation efficiency worsens
Solution Approach 1:
The patent segments the access control function from the abstracted resources and assigns it to a dedicated management entity. The memory device address table is segmented into logical address spaces for different resources, allowing precise control over which resource can access which memory region. This segmentation enables the management entity to make precise access control decisions without requiring each abstracted resource to implement its own monitoring, thus maintaining precision while improving resource allocation efficiency.
Data Source
AI summary
Methods and systems for managing access to a memory device of a data processing system that is shared between a plurality of abstracted resources hosted on the data processing system are disclosed. A memory device may have a secured portion storing information that is used to authenticate requests from the plurality of abstracted resources for accessing the shared memory device. Access to and modification of the secured portion of the shared memory device is granted only to a management entity of the data processing system. The management entity registers memory address ranges of the memory device allocated to each of the plurality of abstracted resources in the secured portion. The management entity uses the registered memory address ranges to verify memory device access requests from the plurality of abstracted resources.