Task-Based Access Control Using Device Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems face challenges in managing access between tasks on multi-core CPUs and shared devices, particularly in detecting task changes and preventing unauthorized access, with issues such as incomplete detection of access level changes and impractical task ID assignment.
Innovation Solution
An access control system that uses unique secret information for each device, allowing access based on task operations, without requiring task ID assignment at each access, employing a device key management table and access filter matrix to determine authorized access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If task ID assignment is performed at each access to manage access rights, then access control precision is improved, but device complexity and processing overhead increase significantly
Solution Approach 1:
The system performs preliminary action by assigning a task ID to each task when it is created, and preliminarily establishing the correspondence between tasks and devices in a table structure. This preliminary setup eliminates the need for complex real-time task ID assignment at each access point, thereby reducing access management complexity while maintaining precise access control.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a table that stores correspondence relationships between task IDs and device IDs. This intermediary structure allows the access control unit to efficiently determine authorized access without performing complex real-time analysis, thus reducing processing overhead while maintaining security.
2Reliability
If access level change detection is performed to improve security, then unauthorized access prevention is improved, but detection accuracy deteriorates when instruction cache is used
Solution Approach 1:
The patent replaces the mechanical/instruction-based detection method with a software-based detection approach. Instead of relying on hardware-level instruction cache monitoring which has accuracy issues, the system uses software to detect task changes by monitoring task switching events and updating the task-device correspondence table accordingly, thereby improving detection accuracy while maintaining security.
Solution Approach 2:
The system implements feedback by continuously monitoring task switching events and using this information to update the task-ID-to-device-ID correspondence relationships. This feedback mechanism ensures that the access control table remains accurate and up-to-date, allowing the system to reliably detect task changes and maintain security even in the presence of instruction caching.
3Ease of operation
If perfunctory security software is used for multi-core CPU communication, then ease of operation is improved, but reliability deteriorates due to memory region destruction and data alteration
Solution Approach 1:
The patent applies segmentation by dividing the memory space into distinct regions associated with different tasks and devices. The system maintains separate task ID to device ID correspondence relationships, which effectively segments the access control logic. This segmentation prevents tasks from accidentally or maliciously accessing each other's memory regions, thereby improving reliability while maintaining ease of operation through simplified access control.
Solution Approach 2:
The system performs preliminary anti-action by pre-establishing the task-ID-to-device-ID correspondence relationships and using these pre-defined relationships to prevent unauthorized access before it can occur. The access control unit checks the correspondence table before allowing any access, thereby preventing memory region destruction and data alteration in advance rather than reacting after damage occurs.
Data Source
AI summary
Provided is the access control system for controlling an access on a task basis without modifying a device side to be accessed and without applying a task ID at each access to a device.The access filter system for controlling an access between devices mounted on an electronic device, which comprises the access control unit for applying a unique device key set for each device as a right to access the device on a basis of a task operable on the electronic device and determining whether to allow an access to the device according to whether an access request task which requests an access to the device has the device key.