SoC MMU Virtualization Security via Hypervisor Stream ID Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Standard system-on-chip (SoC) memory management unit (MMU) virtualization fails to provide adequate security as a rich operating system, acting as a non-secure virtual machine, can compromise security domains by reconfiguring stream IDs, leading to data modification, corruption, or theft across virtual machines.
Innovation Solution
Implementing a method where a hypervisor device manages stream identifiers and address translation contexts to isolate security domains by validating commands and preventing unauthorized mapping of stream identifiers across different security domains, ensuring secure memory access transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a rich operating system is allowed to manage stream IDs for all security domains, then ease of operation is improved, but security is worsened because the non-secure virtual machine can compromise other security domains
Solution Approach 1:
The patent introduces a secure monitor as an intermediary component that sits between the rich operating system and the stream ID management mechanisms. The secure monitor validates and controls stream ID assignments, preventing the non-secure rich OS from directly compromising other security domains while still allowing it to manage stream IDs under supervision. This mediator approach resolves the contradiction by maintaining ease of operation through rich OS involvement while ensuring security through monitor validation.
Solution Approach 2:
The patent segments the stream ID management functionality into different security contexts. Certain stream ID operations are restricted to specific security domains, and the system divides management privileges so that the rich OS can manage only authorized stream IDs while a secure monitor handles cross-domain security validation. This segmentation allows operational flexibility while maintaining security boundaries.
2Adaptability or versatility
If standard MMU virtualization is used to support multiple virtual machines, then adaptability is improved, but security is worsened because sandboxing between domains cannot be achieved
Solution Approach 1:
The secure monitor acts as an intermediary that enforces domain isolation policies between virtual machines. While standard MMU virtualization provides the framework for multiple VMs, the secure monitor intercepts and validates memory access transactions, ensuring that each VM remains sandboxed within its authorized security domain. This prevents the loss of isolation that occurs in standard implementations.
Solution Approach 2:
The patent adds a new dimension of security validation by introducing a separate security domain hierarchy alongside the virtual machine hierarchy. Stream IDs are associated with security domains rather than just VMs, creating an additional layer of isolation. This dimensional change allows the system to maintain VM adaptability while achieving domain isolation through security domain boundaries.
Data Source
AI summary
In an aspect, an apparatus that includes a first security domain and at least a second security domain obtains, at a virtual machine of the first security domain, a stream identifier associated with the second security domain. The apparatus generates, at the virtual machine of the first security domain, a command to map the stream identifier associated with the second security domain to a first address translation context. The apparatus maps, at a hypervisor device, the first address translation context to a second address translation context that is associated with the second security domain of the stream identifier. The apparatus processes a stream of memory access transactions that includes the stream identifier based on at least the first address translation context or the second address translation context.