Shared Memory Controller Access Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for shared memory access in storage class memory (SCM) devices lack efficient access granularity and control, leading to increased overhead and potential data security issues when multiple servers share the same memory, as they rely on file system permissions rather than processor-level read/write commands.
Innovation Solution
A shared memory controller that manages access to a shared memory module by generating temporal access keys based on program authentication and authorization, allowing fine-grained access control similar to processor read/write commands, while ensuring secure access and separation of memory spaces across multiple servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file system permissions are used for access control in shared memory, then data security is maintained, but access overhead increases and processor-level read/write commands cannot be utilized
Solution Approach 1:
The patent segments access control into multiple hierarchical levels: (1) server-level authentication using authentication information, (2) program-level authorization using program IDs, and (3) memory region-level control using base addresses and lengths. This segmentation allows processor-level read/write commands to be used while maintaining security through layered verification.
Solution Approach 2:
The patent introduces an intermediary access control mechanism between the processor and shared memory that validates read/write commands without requiring file system permissions. The controller acts as a mediator that verifies authentication information, program IDs, and memory region boundaries, enabling direct processor access while maintaining security.
2Quantity of substance
If multiple servers share the same SCM device, then memory capacity is increased, but access control and data security become more complex
Solution Approach 1:
The patent implements a universal access control framework that handles multiple servers, programs, and memory regions through a single integrated mechanism. The same authentication and authorization procedures apply regardless of the number of servers or programs, simplifying access control while supporting multi-server sharing of SCM devices.
Solution Approach 2:
The patent applies local quality by assigning specific authentication information and authorization levels to different programs and memory regions. Each program receives tailored access permissions for specific base addresses and lengths, enabling fine-grained control without increasing overall system complexity.
3Loss of time
If fine-grained access control is implemented at processor level, then access overhead is reduced, but implementation complexity increases
Solution Approach 1:
The patent performs preliminary authentication and authorization actions before granting memory access. The controller verifies authentication information and program IDs in advance, establishing access permissions before processor-level read/write commands are executed. This preliminary verification reduces access overhead during actual memory operations.
Solution Approach 2:
The access control mechanism serves itself by automatically verifying authentication information and program IDs without requiring external file system permission checks. The controller independently validates each access request using stored authentication data, eliminating the need for complex external authorization systems.
Data Source
AI summary
According to an embodiment, upon receiving a use request including an identifier of a program and authentication information, a use request processing unit makes a determination on validity of the use request based on an ID management information and access authority management information, generates an access key when the use request is valid, registers the access key in access key management information in correlation with a usable address range, and returns the access key to a transmission source of the use request. Upon receiving a read/write request including an address where reading-out or writing of data is performed and an access key, a read/write request processing unit makes a determination on validity of the read/write request based on the access key management information, and executes reading-out or writing of data with respect to a shared memory in response to the read/write request when the read/write request is valid.