Computational Resource Access Control Using Trusted Runtime Indicators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems face security vulnerabilities due to malicious users modifying compiler annotations to evade resource and process isolation checks, leading to potential security and validity issues in computational resource access.
Innovation Solution
Implement a runtime check and static pre-launch dispatcher check using a resource indicator (e.g., a resource bit) in the execution context and an access table to verify permission for computational resource access, ensuring only legitimate processes can access these resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If compiler annotations are used to indicate resource requirements, then resource dispatching is simplified, but security vulnerabilities arise from malicious users modifying annotations to evade isolation checks
Solution Approach 1:
The patent introduces an intermediary validation mechanism between the compiler annotations and the resource dispatcher. A resource indicator (resource bit) is embedded in the execution context as a trusted intermediary that verifies the legitimacy of resource access requests, preventing malicious users from evading isolation checks through modified annotations.
Solution Approach 2:
The system performs preliminary validation by setting the resource bit in the execution context before the computation task executes. This preliminary action ensures that the resource ownership is verified in advance, preventing unauthorized access while maintaining the simplicity of compiler-based resource indication.
2Reliability
If runtime checks are implemented to verify resource access permissions, then security is improved, but processing overhead increases
Solution Approach 1:
The patent extracts the resource permission verification logic from the main execution path by using a dedicated resource bit in the execution context. This allows the security check to be performed as a separate, efficient operation that does not significantly impact the main processing throughput, as the resource bit can be checked with minimal overhead compared to full validation protocols.
Data Source
AI summary
Resource access control is described. In accordance with the described techniques, a process (e.g., an application process, a system process, etc.) issues an instruction seeking access to a computation resource (e.g., a processor resource, a memory resource, etc.) to perform a computation task. An execution context for the instruction is checked to determine whether the execution context includes a resource indicator indicating permission to access the processor resource. Alternatively or additionally, the instruction is checked against an access table which identifies processes that are permitted and/or not permitted to access the computation resource.