Trusted Driver Module Architecture for PCIe SR-IOV Device Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Confidential Computing (CC) technologies face challenges in providing hardware-based isolation for sensitive workloads like AI due to privileged access vulnerabilities in Physical Function (PF) drivers, which violate isolation requirements and expose devices to attacks such as spoofing and hijacking, especially in PCIe SR-IOV environments.
Innovation Solution
A software-protected solution is introduced by refactoring the monolithic PF driver into two components: one operating in a highly secure trusted host and the other in a lower-privileged host, using a novel driver architecture to protect sensitive assets and enhance security without requiring significant hardware changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Confidential Computing technologies are implemented with hardware-based isolation, then security protection against unauthorized access and tampering is improved, but device complexity and silicon investment requirements increase
Solution Approach 1:
The patent introduces a trusted driver module as an intermediary component that mediates between untrusted application programs and protected system resources. This trusted module runs in a secure domain (such as a Trusted Execution Environment or secure kernel) and enforces security policies, allowing hardware-based isolation to be achieved through software architecture rather than requiring extensive hardware modifications. The intermediary validates and controls access to resources, providing security protection while avoiding the need for complex silicon investments.
2Ease of operation
If PF drivers are given privileged access for device configuration, then device control capability is improved, but security vulnerabilities such as spoofing and hijacking increase
Solution Approach 1:
The patent segments the PF driver functionality into two distinct components: an untrusted driver module that handles high-level application interactions and a trusted driver module that resides in a secure domain and handles sensitive resource management. This segmentation allows device control capability to be maintained through the untrusted module's interface while the trusted module enforces security policies and prevents harmful actions. The separation of duties enables privileged access to be granted only to the trusted component, reducing security vulnerabilities while preserving operational capability.
3Reliability
If hardware-based isolation is implemented for sensitive workloads, then protection against attacks is improved, but implementation time and development timeline increase
Solution Approach 1:
The patent implements security measures through software architecture that can be deployed on existing hardware platforms without requiring lengthy hardware development cycles. By using preliminary action, the solution leverages available hardware virtualization features and existing secure execution environments to establish protection against attacks immediately through software configuration and trusted driver implementation, rather than waiting for custom hardware development.
4Ease of manufacture
If monolithic PF driver architecture is used for simplicity, then ease of manufacture is improved, but security control and isolation capability deteriorate
Solution Approach 1:
The patent divides the monolithic PF driver into separate trusted and untrusted driver modules, each with specific security responsibilities. The untrusted module handles application-facing operations while the trusted module enforces security policies and manages protected resources. This segmentation maintains relative implementation simplicity while dramatically improving security control and isolation capability through the introduction of a trusted execution boundary.
Solution Approach 2:
The trusted driver module acts as an intermediary between untrusted applications and protected system resources, enforcing security policies and preventing unauthorized access. This intermediary layer maintains ease of operation for applications while providing robust security control, resolving the contradiction between simplicity and security in driver architecture.
Data Source
AI summary
Provided is a computer-readable medium including computer-readable instructions. When the instructions are executed by a computer, the computer may implement a method. According to this method, a configuration operation on a target resource is requested by a non-secure domain. Furthermore, the configuration operation on the target resource is performed upon determining that the configuration operation requested by the non-secure domain is permissible, where the secure domain is configured such that the resource protected by the secure domain is free from attacks by an agent external to the trusted driver module.