Shared Memory Segmentation for Secure Cross-Platform Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current implementations of memory sharing between processes hosted by separate computing platforms lack strict isolation mechanisms, leading to security vulnerabilities such as unrestricted read/write access, lack of real-time data inspection, and inability to dynamically regulate access based on data format validation.
Innovation Solution
Implementing a two-level isolation mechanism for shared memory that includes host-level access control as a first isolation and data-level inspection and policy enforcement as a second isolation, using controlled shared memory (COSM) management circuitry to manage access to shared memory regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If memory sharing is implemented between processes on separate computing platforms, then inter-process communication speed is improved, but security isolation is worsened
Solution Approach 1:
The patent segments the shared memory access control into multiple isolation layers: domain-level isolation (first isolation) and application-level isolation (second isolation). This segmentation allows the system to maintain both high-speed memory sharing and strong security by enforcing different access control policies at different hierarchical levels, preventing unauthorized access while enabling legitimate high-performance communication.
Solution Approach 2:
The patent introduces an intermediary isolation mechanism (the controlled shared memory device with management circuitry) between the computing platforms and shared memory. This intermediary enforces access control policies, validates data formats, and monitors memory transactions, thereby maintaining security isolation while enabling fast memory-based communication without requiring data copying.
2Ease of operation
If coarse-grained access control is used for shared memory, then ease of operation is improved, but security is worsened
Solution Approach 1:
The patent divides access control into fine-grained segments: domain-level permissions (read/write/access denial) and application-level permissions (specific memory region access). This segmentation enables precise security control without significantly complicating operation, as the isolation management circuitry automatically enforces these granular policies based on configured rules.
Solution Approach 2:
The patent implements dynamic access control where permissions can be adjusted based on data format validation and policy enforcement. The isolation management circuitry can dynamically allow or deny access based on real-time inspection of memory transactions, providing adaptability while maintaining ease of operation through automated policy application.
3Reliability
If data-level inspection and policy enforcement are added to shared memory access, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent introduces a specialized intermediary device (controlled shared memory with isolation management circuitry) that consolidates data-level inspection and policy enforcement functions. This intermediary handles the complexity of security validation, format checking, and policy enforcement internally, presenting a simplified interface to host systems while maintaining strong security isolation through automated enforcement mechanisms.
Data Source
AI summary
Examples include techniques associated for multiple isolations for shared memory. Examples include the shared memory being included on or at an externally-attached shared memory device. The shared memory at the externally-attached shared memory device can be shared between multiple domains hosted by one or more host computing platforms. The multiple isolations to be established for memory access transactions to the shared memory by one or more domains that can access the shared memory.