Thread Sandboxing With Memory Locking for Untrusted Code Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The integration of untrusted third-party libraries in computing systems introduces security concerns, as vulnerabilities in these libraries can lead to data corruption or loss, especially in communication software exposed to external entities.
Innovation Solution
A sandboxing technique is employed to execute untrusted threads by restricting their memory access to specific, clearly defined regions, using a secure processing environment to isolate critical system data and resources, implemented through a memory locking service and Security Attribution Unit (SAU) in a TrustZone-M architecture.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If third-party libraries are integrated to support system functionality, then system versatility and functionality are improved, but security reliability deteriorates due to vulnerabilities in untrusted code
Solution Approach 1:
The patent segments the processing environment into secure and non-secure domains, and further divides memory into sandboxed regions accessible only by specific threads. This allows third-party libraries to execute in isolated memory regions, maintaining system functionality while preventing security breaches from propagating to critical system resources.
Solution Approach 2:
The patent introduces a memory locking service and Security Attribution Unit as intermediary components between untrusted third-party code and critical system resources. These intermediaries enforce access control policies, allowing versatile software integration while maintaining security reliability through controlled memory access.
2Reliability
If memory access restrictions are imposed on sandboxed threads, then security reliability is improved, but device complexity increases due to memory locking service and environment switching
Solution Approach 1:
The patent implements self-service mechanisms where the memory locking service automatically manages sandbox enforcement and the Security Attribution Unit autonomously handles memory access validation. This reduces the need for complex external control logic, managing security reliability through automated rather than manual complexity.
Solution Approach 2:
The patent designs the memory locking service and Security Attribution Unit to provide multiple functions: enforcing sandbox boundaries, controlling memory access, and managing secure/non-secure environment transitions. This multi-functionality consolidates security mechanisms into unified components, reducing overall system complexity while maintaining high security reliability.
3Reliability
If threads are associated with secure processing environment to prevent unauthorized access, then security reliability is improved, but processing speed deteriorates due to environment switching overhead
Solution Approach 1:
The patent implements periodic sandbox enforcement where the secure processing environment is activated only when threads access critical memory regions or during scheduled security checks. During normal execution, threads operate in the faster non-secure environment, achieving security reliability through periodic validation rather than continuous environment switching.
Solution Approach 2:
The patent applies secure processing environment association partially - only to specific memory regions and threads that require protection, rather than universally to all operations. This selective application maintains security reliability for critical resources while minimizing processing speed degradation by avoiding unnecessary environment switches for non-critical operations.
Data Source
AI summary
This disclosure describes approaches for sandboxing a thread and memory resources within non-secure/secure processing environments such as in a TrustZone-M processor architecture. An example method of controlling memory access includes: providing a memory locking service in a computing device having a secure processing environment and a non-secure processing environment, and executing the memory locking service in the secure processing environment; receiving a request with the memory locking service to establish a sandbox for a particular thread that executes in the non-secure processing environment and is associated with at least one specified memory region; and associating other threads of the non-secure processing environment with the secure processing environment, such that the particular thread is unable to access memory resources of the other threads while the particular thread is sandboxed.