Virtual Environment Harvard Architecture Memory Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional sandbox environments struggle to securely execute untrusted software modules without exposing the memory layout of the computer system, making them vulnerable to attacks like return-oriented programming (ROP) due to the lack of distinct memory access controls.
Innovation Solution
Implementing a virtual environment with a Harvard architecture on a von Neumann-style computer, where instruction memory is unreadable and data memory is accessible, allowing for the execution of untrusted modules while preventing access to instruction memory, thereby hiding the memory layout and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a conventional sandbox environment uses a single memory for storing data and instructions, then the device complexity is reduced, but the security against memory layout discovery and ROP attacks deteriorates
Solution Approach 1:
The patent divides the single memory into two separate memory spaces: instruction memory for storing executable instructions and data memory for storing data. This segmentation prevents untrusted modules from accessing instruction memory while maintaining separate storage functions, thereby improving security without requiring complex hardware memory architecture.
Solution Approach 2:
The patent introduces an intermediary memory access control mechanism that mediates between the untrusted module and the memory spaces. The system permits access to data memory while blocking access to instruction memory, acting as a protective intermediary that enables safe execution of untrusted code without exposing the complete memory layout.
2Ease of operation
If a virtual environment allows untrusted modules to access any memory, then the ease of operation is improved, but the security against harmful factors deteriorates
Solution Approach 1:
The patent segments memory access permissions by creating distinct memory spaces with different access controls. Untrusted modules can execute and access data memory freely, maintaining ease of operation, while instruction memory remains protected from access, preventing memory layout discovery and ROP attacks.
Solution Approach 2:
The patent converts the potential harm of memory access into a benefit by selectively permitting access to data memory while blocking access to instruction memory. This selective permission system turns what could be a security vulnerability into a protective feature, allowing modules to function while preventing harmful memory layout discovery.
3Reliability
If the instruction memory is made unreadable by instructions, then the security against ROP attacks is improved, but the device complexity increases
Solution Approach 1:
The patent implements segmentation by creating separate instruction memory and data memory spaces with different access permissions. The instruction memory is configured to be unreadable by instructions, while data memory remains accessible. This segmentation achieves ROP attack protection through a relatively simple architectural division rather than complex access control mechanisms.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, relating to software execution. One of the methods includes executing, on a computer including a single memory for storing data and instructions, a virtual environment including a data memory and an instruction memory, the instruction memory configured to be unreadable by instructions stored in the instruction memory; receiving, at the virtual environment, a software module comprising multiple instructions; and performing validation of the software module including: identifying, in the software module one or more calls to the single memory; and verifying that the one or more calls to the single memory are in the data memory.