SoC Pre-emption Interrupts for Dynamic Runtime Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security architectures for system-on-chip (SoC) information handling systems are vulnerable to malicious attacks due to weaknesses in privilege-based isolation schemes and dedicated secure enclave subsystems, which can be compromised by privilege-escalation attacks and lack dynamic runtime isolation control.
Innovation Solution
A dynamic runtime isolation architecture is implemented using a dedicated SoC control point entity that creates and maintains programmable isolation barriers around each execution domain through a two-way control channel data stream, providing hardware-enforced mechanisms for software protection, isolation, and virtualization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If privilege-based isolation schemes are used to protect processing subsystems, then isolation between processors or partitions is provided, but the schemes can be compromised by privilege-escalation attacks that infect or compromise the operating system or hypervisor
Solution Approach 1:
The system segments the processing architecture into distinct privilege levels (supervisor mode and user mode) with hardware-enforced boundaries. The processor core is divided into separate execution contexts that cannot be arbitrarily accessed or modified by software, creating isolated security zones that prevent privilege-escalation attacks from compromising the entire system.
Solution Approach 2:
A control channel acts as an intermediary between the isolated processing subsystems and the rest of the system. This control channel enforces access policies and mediates all interactions, preventing direct access that could lead to privilege escalation while maintaining necessary communication and coordination between subsystems.
2Reliability
If dedicated secure enclave subsystems with address space control mechanisms are implemented, then boot control and isolation barriers are provided, but the physical interconnection infrastructure and CPUs connected on the other side remain unprotected
Solution Approach 1:
The system extends segmentation to the interconnection infrastructure by creating isolated network segments and enforcing security policies at multiple levels. Each processing subsystem operates in its own secure context, and the interconnect is configured to enforce access controls, ensuring that compromises in one area cannot propagate to unprotected areas.
3Reliability
If filtering hardware is used to prevent unauthorized access to memories or peripherals, then access control based on source identification is provided, but the solution depends on the integrity of the master processor's privilege mechanism
Solution Approach 1:
The control channel serves as an intermediary that implements access control independently of the processor's privilege mechanism. It receives and enforces access policies without relying on the integrity of processor privilege levels, providing a separate layer of security that filters unauthorized access to memories and peripherals based on configured policies rather than processor state.
4Reliability
If isolation techniques relying on virtual memory space management are used, then software entity isolation is provided, but the techniques can be circumvented by corrupting memory mapping tables
Solution Approach 1:
The system implements segmentation at the hardware level rather than relying solely on software-managed virtual memory. By enforcing isolation boundaries through processor architecture and control channels, the system prevents circumvention through memory mapping table corruption, as the security boundaries are maintained independently of software memory management structures.
Data Source
AI summary
A method and apparatus are disclosed for a multi-processor SoC which includes an execution domain processor for running an execution domain which hosts independent software partitions by accessing, for each software partition, one or more SoC resources; a control point processor that generates control data with pre-emption vectors for controlling access to the SoC resources by identifying at least a first SoC resource that each software partition is allowed to access; and an access control circuit connected between the execution domain and the SoC resources and configured to provide, in response to the control data, a dynamic runtime isolation barrier which enables the execution domain processor to switch between software partitions in response to a pre-emption interrupt trigger by fetching partition instructions from a corresponding pre-emption interrupt vector address in memory that is associated with the pre-emption interrupt trigger.