Trusted Application Execution Provisioning for Secure Memory Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems face challenges in ensuring the trusted execution of applications due to vulnerabilities in perimeter protection approaches, which fail to effectively prevent attacks from within and outside the execution space, leading to risks of data breaches and unauthorized modifications.
Innovation Solution
The implementation of a Trusted Application Execution Provisioning (TAEP) system that creates a Trusted Application Pattern Space (TAPS) within computing systems, ensuring exclusive and immutable control over critical execution mechanisms, such as processor registers and memory, to isolate and protect application instruction and data spaces from unauthorized access or modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If perimeter protection approaches are used to secure applications, then known individual attacks can be addressed, but attacks from within and outside the execution space can still compromise data and instructions
Solution Approach 1:
The patent divides the application execution space into distinct isolated segments: a protected application space containing the application code and data, and separate privileged spaces for system software. Memory protection mechanisms enforce these segment boundaries, preventing unauthorized access between segments while allowing controlled communication through defined interfaces.
Solution Approach 2:
The patent implements nested execution environments where a trusted execution environment (TEE) contains the application space, which in turn contains the application code and data. Multiple layers of protection are nested within each other, with each layer providing security functions and isolating its contents from outer layers, creating a hierarchical security structure.
2Adaptability or versatility
If shared resources and libraries are used to enable application functionality, then application versatility is improved, but attack vectors increase through shared code exploitation
Solution Approach 1:
The patent extracts shared libraries and system code from the application's protected execution space into separate privileged execution spaces. This extraction removes potential attack vectors from within the application space while maintaining the functionality of shared resources through controlled access mechanisms and inter-space communication protocols.
3Ease of operation
If privileged software and system mechanisms are used to manage computing resources, then system control is improved, but attack surfaces expand through privileged software vulnerabilities
Solution Approach 1:
The patent introduces privileged software as an intermediary layer between the application space and system resources. This intermediary operates in a separate privileged execution space, managing resource access requests from applications through controlled interfaces. The intermediary architecture isolates system resource management functions from application code, reducing the attack surface while maintaining operational control.
Data Source
AI summary
A system and methodology for providing trusted execution of applications is provided. The computing system includes system hardware including memory. A Trusted Application Execution Provisioning (TAEP) operating on said computing system enforces a Trusted Application Pattern Space (TAPS) within the memory throughout the execution lifecycle of each application hosted on the computing system. The Trusted Application Execution Provisioning (TAEP) assigns each application a private application instruction space and a private application data in accordance with specifications governing the Trusted Application Pattern Space (TAPS), such that the Trusted Application Execution Provisioning (TAEP) prevents the private application instruction space of each application from being read, inferred, and/or modified by any application, and prevents the private application data space of each application from being read, inferred, and/or modified by other than its assigned application. Upon an extension request by a first application to extend with one or more collaborating applications, the Trusted Application Execution Provisioning (TAEP) assigns an application collaboration data space within the memory in accordance with the specifications governing the Trusted Application Pattern Space (TAPS), such that both the first application and the one or more collaborating applications have access to the application collaboration data space. The Trusted Application Execution Provisioning (TAEP) prevents the application collaboration space from being read, inferred, and/or modified by other than the first application and the one or more collaborating applications.