Unified Stack Architecture for Secure Domain Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face challenges in providing secure access to sensitive data and code while maintaining low latency and area efficiency, particularly in small systems like microcontrollers, where security measures often compromise performance.
Innovation Solution
A data processing apparatus with a data store comprising secure and less secure regions, using separate stacks for each domain, and a stack select flag to determine which stack to access for function arguments and return values based on the security level of the code being executed, allowing efficient switching between secure and non-secure domains without additional hardware or software intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate secure and non-secure stacks are used to maintain security isolation, then security is improved, but device complexity increases
Solution Approach 1:
The patent combines the secure and non-secure stacks into a single unified stack structure in memory, rather than maintaining completely separate stack regions. This allows the system to preserve security through domain-based access control while reducing the complexity of managing multiple separate stack structures and their associated control logic.
Solution Approach 2:
The unified stack serves multiple functions by supporting both secure and non-secure domains within the same memory structure. The stack can be dynamically accessed by either domain depending on the current security state, eliminating the need for separate dedicated stack structures for each domain and reducing overall device complexity.
2Reliability
If software exception handlers are used to transition between secure and non-secure states, then security is improved, but productivity decreases
Solution Approach 1:
The system automatically manages stack switching between secure and non-secure domains through hardware-based domain state tracking. When the processor transitions between security domains, the stack pointer automatically switches between secure and non-secure stack regions without requiring software exception handlers or manual intervention, thereby improving productivity while maintaining security.
3Reliability
If multiple separate stacks are maintained for different security domains, then security is improved, but area usage increases
Solution Approach 1:
The patent merges multiple domain-specific stacks into a single unified stack structure shared by both secure and non-secure domains. This consolidation reduces the total memory area required compared to maintaining separate dedicated stacks for each domain, while security is preserved through domain-based access control mechanisms that prevent unauthorized access to sensitive stack regions.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A data processing apparatus comprising: data processing circuitry for performing data processing operations in response to program code; a plurality of registers; and a data store for storing data, the data store comprising a plurality of regions having different secure levels, and comprising at least one secure region for storing sensitive data accessible by the data processing circuitry operating in the secure domain and not accessible by the data processing circuitry operating in a less secure domain and a less secure region for storing less secure data. The data store comprises at least two stacks a secure stack in the secure region and a less secure stack in the less secure region. The data processing circuitry operates in the secure domain when processing program code stored in the secure region and operates in the less secure domain when processing program code stored in the less secure region; wherein the data processing circuitry is configured to determine which stack to store data to, or load data from, in response to the storage location of the program code being executed. In response to program code stored, in a first region calling a function to be executed, the function code being stored in a second region, the second region having a different secure level to the first region, the data processing circuitry is configured to determine which of the first and second region have a lower secure level and when executing the program code and the function code, to access the stack of the region with the lower secure level for function arguments and return data values.