Snoop Module Hardware Memory Access Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electronic devices face inefficiencies in monitoring and preventing abnormal memory access attacks, such as DDoS and ransomware, due to resource-intensive page-fault and domain-fault systems that are based on page and domain granularity, leading to performance degradation.
Innovation Solution
An electronic device equipped with separate hardware, including a processor and a snoop module, that monitors and controls access to specific memory areas by loading application codes into a second memory, using access information from the kernel to execute the application program, and switching between execution modes to manage access permissions and logging.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If page-fault or domain-fault systems are used to monitor memory access, then security verification can be performed, but processor resource consumption increases and performance degrades
Solution Approach 1:
The patent divides the monitoring function into two parts: hardware-level snoop for real-time access detection and software-level page-fault/domain-fault systems for security verification. This segmentation allows the hardware to handle routine monitoring efficiently while the software system only intervenes when actual security issues are detected, reducing overall processor resource consumption.
Solution Approach 2:
The patent introduces a snoop module as an intermediary hardware component that sits between the processor and memory. This snoop module intercepts and monitors memory access requests before they reach the processor, filtering out normal accesses and only triggering processor intervention when abnormal access patterns are detected, thus reducing processor workload.
2Reliability
If page-fault or domain-fault systems are used to monitor memory access, then security verification can be performed, but the monitoring becomes inefficient for small memory sizes due to page and domain granularity
Solution Approach 1:
The patent segments the monitoring function into hardware-level snoop operations that can track individual memory address accesses and software-level fault systems that operate at page/domain granularity. This allows precise monitoring of small memory areas through the hardware snoop while maintaining the broader security verification capability of the software system.
Solution Approach 2:
The patent replaces the software-based mechanical fault system with a hardware-based snoop mechanism for fine-grained memory monitoring. The hardware snoop can detect abnormal accesses at the byte or word level, providing much higher precision than the page-level (4KB) or domain-level (16MB) granularity of traditional fault systems.
3Speed
If separate hardware is introduced to monitor memory access, then real-time detection capability is improved, but device complexity increases
Solution Approach 1:
The patent designs the snoop module as a universal hardware component that can monitor multiple memory regions and handle various types of access patterns (read, write, execute) through a single unified structure. This multi-functionality reduces the need for separate monitoring hardware for different memory areas, thereby limiting the increase in device complexity.
Solution Approach 2:
The snoop module is designed to operate autonomously, automatically detecting abnormal memory accesses and generating appropriate interrupt signals without requiring constant processor intervention. This self-service capability allows real-time monitoring while keeping the hardware structure relatively simple, as the snoop module handles its own operation and only engages the processor when necessary.
Data Source
AI summary
An electronic device is disclosed. An electronic device comprises: a first memory in which an operating system and an application program executed on the operating system are stored; a second memory; a processor for loading at least some codes among codes corresponding to an application program from the first memory to the second memory, and when access information of the codes loaded in the second memory is received from a kernel of an operating system, accessing an area in which the loaded codes are stored, on the basis of the received information and executing the application program; and a snoop for monitoring access to an area in which a preset code, the access of which has been limited, from among codes loaded in the second memory is stored.