Secure Shared Memory Interface for Application Processes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization technologies lack a secure mechanism for sharing data between application processes running on shared resources, which poses a risk to the security of the underlying hardware and resources.
Innovation Solution
A secure shared memory interface is implemented between master and slave application process instances, utilizing unidirectional descriptor rings for communication and authentication to ensure secure data exchange, with the slave instance allocating memory regions and the master instance maintaining control without exposing resources, thereby protecting against software defects or malicious actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If virtualization is used to share hardware resources across multiple application processes, then resource utilization and flexibility are improved, but security risks increase due to lack of protection mechanisms
Solution Approach 1:
The shared memory is divided into multiple regions, with each region dedicated to specific communication directions (slave-to-master or master-to-slave). This segmentation isolates potential security threats to specific regions while maintaining overall system resource sharing capabilities.
Solution Approach 2:
Descriptor rings are introduced as intermediary data structures that mediate all communication between master and slave processes. These descriptor rings act as controlled access points, allowing data exchange while preventing direct unauthorized access to shared memory regions.
2Productivity
If direct shared memory access is implemented between application processes, then communication efficiency is improved, but system stability deteriorates due to potential corruption or malicious behavior
Solution Approach 1:
Different regions of shared memory are assigned different security qualities and access permissions. Regions dedicated to slave-to-master communication have different protection characteristics than master-to-slave regions, allowing optimized performance while maintaining appropriate security constraints for each communication direction.
Solution Approach 2:
The master process pre-allocates and initializes descriptor rings and shared memory regions before slave processes attempt to communicate. This preliminary setup ensures that all communication structures are validated and secured before actual data exchange begins, preventing runtime corruption.
3Object-affected harmful factors
If authentication mechanisms are added to protect shared resources, then security is improved, but device complexity increases
Solution Approach 1:
The authentication and authorization logic is embedded within the descriptor ring structures themselves, rather than requiring separate authentication subsystems. The descriptor rings inherently enforce access rules through their design, allowing security to be implemented without adding external complexity.
Data Source
AI summary
A secure shared memory interface for computer application processes is described. In one embodiment, a method includes initiating a shared memory interface between a master application process instance and a slave application process instance running on a computer. The method also includes allocating one or more regions within a memory allocation of the slave application process instance to the shared memory interface. The method further includes generating a first descriptor ring and a second descriptor ring in each region of the one or more regions of the shared memory interface. The master application process instance and the slave application process instance exchange information by adding one or more packets to at least one region of the one or more regions of the shared memory interface.