SoC Memory Control Unit for Rogue Process Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
System on chip (SoC) devices face vulnerabilities due to rogue processes that can exceed expected memory access limits, potentially causing security violations and damage, as existing technologies lack effective mechanisms to restrict and monitor memory access securely.
Innovation Solution
Implementing a memory control unit (MCU) within the SoC that allocates memory regions, monitors process activity counts, and disables access when maximum or minimum thresholds are exceeded, using configurable parameters to ensure valid process behavior and prevent security violations by blocking memory regions for rogue processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If memory access is allowed without restrictions, then process execution flexibility is improved, but security vulnerabilities increase due to rogue processes
Solution Approach 1:
The memory space is segmented into multiple regions, each allocated to specific processes. The memory control unit divides memory access rights by process, allowing each process to operate within its designated memory region. This segmentation enables flexible process execution while preventing rogue processes from accessing unauthorized memory areas, thus resolving the contradiction between execution flexibility and security.
Solution Approach 2:
The memory control unit acts as an intermediary between processes and memory regions. It monitors and controls memory access requests, verifying whether processes have authorization to access specific memory regions. This intermediary mechanism maintains process execution flexibility while enforcing security constraints to prevent harmful activities.
2Reliability
If memory regions are disabled to prevent rogue processes, then security is improved, but process activity monitoring capability deteriorates
Solution Approach 1:
The system performs preliminary actions by allocating memory regions and setting up access control parameters before processes execute. The memory control unit pre-configures which processes can access which memory regions, enabling security enforcement without interfering with ongoing process activity monitoring. This preliminary setup maintains both security and monitoring capability.
Solution Approach 2:
The memory control unit continuously monitors process activity and provides feedback on memory access patterns. It tracks whether processes are operating within their allocated memory regions and adjusts access permissions dynamically based on observed behavior. This feedback mechanism ensures security while maintaining the ability to detect and measure process activity.
3Measurement precision
If process activity is monitored continuously, then security detection is improved, but system performance deteriorates due to overhead
Solution Approach 1:
The monitoring and control functions are extracted from the main processing unit and implemented as a separate memory control unit. This extraction allows continuous process activity monitoring to be performed in parallel with normal processing operations, improving detection precision without significantly impacting system performance. The dedicated control unit handles monitoring tasks independently.
Solution Approach 2:
The memory control unit performs self-service by autonomously monitoring process activity and enforcing access controls without requiring constant intervention from the processing unit. It independently tracks process behavior, verifies access permissions, and disables unauthorized access, reducing the overhead on the main processing system while maintaining precise monitoring capability.
Data Source
AI summary
A system on chip, comprising a processing unit for executing processes, a memory unit, and a memory control unit connected between the processing unit and the memory unit, is described. The memory control unit allocates a memory region to a process. The memory control unit comprises a process activity counter which counts a duration of the process or transactions by the process to or from the memory region and which maintains a process activity count representing the counted duration of the process or the counted transactions to or from the memory region. The memory control unit disables the memory region in response to the process activity count exceeding a maximum process activity count. Notably, it blocks the memory region against further transactions by the process and against transactions by any other processes.A method of operating a system on chip is also described.