TLB Secure State Storage for Memory Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face inefficiencies and performance degradation in protecting high-value assets due to software-based protection schemes and hardware-based 'carve-out' memory protection methods, which either waste memory resources or slow down system execution.
Innovation Solution
A system that manages access requests to protected memory regions using a memory management unit and translation lookaside buffer (TLB) to dynamically store and retrieve secure state information, allowing flexible and effective protection of high-value assets without pre-allocating contiguous secure memory blocks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If contiguous blocks of memory are reserved for secure operations at boot time, then security protection for high-value assets is provided, but memory resources are wasted when fewer secure memory blocks are needed and system execution slows down when more secure memory blocks are needed
Solution Approach 1:
The patent implements dynamic secure state information storage in the TLB, allowing the secure memory allocation to adapt automatically to application needs. The MMU dynamically determines secure state information based on physical addresses and stores it in TLB cache lines, eliminating the need for static contiguous memory reservations. This dynamic approach resolves the contradiction by enabling both strong security protection and maintained system execution speed.
2Reliability
If contiguous blocks of memory are reserved for secure operations, then vendor requirements for securing high-value assets are satisfied, but virtual memory architecture efficiencies are reduced
Solution Approach 1:
The patent segments secure state information storage from the traditional contiguous memory block approach. Instead of reserving large contiguous blocks, the system stores secure state information at the page level in TLB entries, allowing individual pages to be marked as secure. This segmentation enables fine-grained security control while preserving virtual memory allocation flexibility and efficiency.
Solution Approach 2:
The patent adds a new dimension to memory security by incorporating secure state information into the TLB structure itself. Rather than securing memory through physical address reservation, the system uses an additional security dimension embedded in the page table entries and TLB cache lines. This allows security to be enforced at the virtual memory management level without impacting allocation flexibility.
3Reliability
If the number of contiguous secure memory blocks is increased during operation, then sufficient secure memory is provided, but data relocation is required which reduces execution speed
Solution Approach 1:
The patent uses copying by storing secure state information in TLB cache lines rather than physically relocating data in memory. When secure memory availability needs to change, the system simply updates the secure state information in the TLB entries, which is a fast copy operation. This eliminates time-consuming data relocation while ensuring secure memory availability meets application requirements.
Data Source
AI summary
One embodiment of the present invention includes a memory management unit (MMU) that is configured to efficiently process requests to access memory that includes protected regions. Upon receiving an initial request via a virtual address (VA), the MMU translates the VA to a physical address (PA) based on page table entries (PTEs) and gates the response based on page-specific secure state information. To thwart software-based attempts to illicitly access the protected regions, the secure state information is not stored in page tables. However, to expedite subsequent requests, after the MMU identifies the PTE and the corresponding secure state information, the MMU stores both the PTE and the secure state information as a cache line in a translation lookaside buffer. Advantageously, the disclosed embodiments protect data in the protected regions from security risks associated with software-based protection schemes without incurring the performance degradation associated with hardware-based “carve-out” memory protection schemes.