Security Processor Memory Management Unit for Restricted Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional computer systems lack a robust mechanism to prevent peripheral devices and processor cores from accessing sensitive portions of system memory, leading to potential corruption, system instability, and security breaches.
Innovation Solution
A secure computer system architecture that includes a security processor and memory management units (MMUs) to restrict access to specific ranges of physical addresses in system memory, preventing unauthorized access by peripheral devices and processor cores through a combination of security processor management and bus-based communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If peripheral devices are allowed to access system memory directly via DMA, then data transfer efficiency is improved, but system security deteriorates due to potential unauthorized access to sensitive memory areas
Solution Approach 1:
The patent introduces an IOMMU (Input-Output Memory Management Unit) as an intermediary between peripheral devices and system memory. The IOMMU intercepts and validates DMA access requests, checking whether the requested memory addresses fall within authorized ranges. This mediator enables efficient DMA transfers while preventing unauthorized access to sensitive memory areas, thus resolving the security-efficiency contradiction.
2Reliability
If a security processor with memory management units is added to restrict access to system memory, then system security is improved, but device complexity increases
Solution Approach 1:
The patent designs the security processor and its integrated MMUs to serve multiple functions: managing memory access permissions for both CPU and peripheral devices, implementing address translation, and providing unified security protection across the entire system. This multi-functional approach consolidates security mechanisms into a single integrated subsystem, reducing overall system complexity while maintaining comprehensive security.
3Reliability
If restricted memory ranges are enforced for processor cores, then protection of sensitive data is improved, but processor performance may deteriorate due to additional access checks
Solution Approach 1:
The patent implements a mechanism where the security processor pre-configures memory access permission tables and restricted ranges before the CPU begins operation. These pre-established rules are stored in dedicated data structures that the MMU can quickly reference during runtime. By performing the complex permission setup in advance rather than evaluating access rules in real-time, the system achieves strong data protection with minimal impact on processor performance.
Data Source
AI summary
A computer system is provided for preventing peripheral devices and/or processor cores from accessing restricted portions of system memory. For example, the computer system can include a host bridge, system memory coupled to the host bridge via a first access bus, a security processor coupled to the host bridge via a memory access bus that allows the security processor to access system memory and to access the peripheral device, and a security processor memory management unit (SPMMU) coupled between the peripheral device and the host bridge. The security processor is configured to program the SPMMU via the memory access bus to specify a first restricted range of physical addresses in the system memory that the peripheral device is not permitted to access. The SPMMU can then process access requests from the peripheral device and deny access requests that are determined to be within the first restricted range.