Virtual Key Memory Protection for Process-Level Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security systems face challenges in protecting memory data at a granularity above the page level, particularly in ensuring that only authorized processes or tasks can access sensitive information, as variables going out of scope or being de-allocated in memory allocation systems can lead to unauthorized access.
Innovation Solution
A key-based approach is implemented, where physical page keys are associated with virtual keys corresponding to processes or tasks, with a data protection bit indicating the protective status of memory pages. This involves generating physical keys for each page, deriving virtual keys for authorized processes, and storing these keys in tables and registers to control access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data is protected at the page level using existing memory protection mechanisms, then basic memory security is provided, but granular control over larger quantities of memory cannot be achieved
Solution Approach 1:
The patent segments memory protection into multiple levels: physical page keys for fine-grained page-level control, virtual keys for process-level access, and data protection bits for coarser-grained region control. This hierarchical segmentation enables granular control over large memory quantities while managing complexity through structured organization of protection mechanisms at different levels.
Solution Approach 2:
The patent implements nested key structures where virtual keys contain physical page keys, and data protection bits encapsulate both physical and virtual key mechanisms. This nesting allows the system to provide detailed page-level protection within the context of larger memory regions, achieving fine-grained control without proportionally increasing overall system complexity.
2Reliability
If memory protection is extended to process level with virtual keys, then authorized process access is ensured, but the complexity of key generation and validation increases
Solution Approach 1:
The virtual key mechanism serves multiple functions simultaneously: it identifies authorized processes, validates access rights, and contains physical page keys for actual memory protection. This multi-functionality reduces the need for separate validation mechanisms, thereby limiting the increase in complexity while ensuring reliable authorized access control.
Solution Approach 2:
The virtual key acts as an intermediary between the process identification system and the physical memory protection system. It mediates by containing both process authorization information and the actual physical page keys, simplifying the interaction between different protection layers and reducing the complexity of direct key generation and validation mechanisms.
3Reliability
If data protection bits are set to indicate protective status, then compliance with data security requirements is improved, but the overhead of protection bit management increases
Solution Approach 1:
The data protection bit is applied locally to specific memory regions rather than universally to all memory. This allows compliance with data security requirements for sensitive data while avoiding the overhead of protection bit management for unrelated memory areas, thereby maintaining memory access efficiency for non-sensitive data.
Solution Approach 2:
The system applies data protection bits selectively to only those memory regions that require enhanced protection, rather than applying protection uniformly across all memory. This partial application reduces the overhead of protection bit management while still ensuring compliance with data security requirements for the necessary data.
4Adaptability or versatility
If physical page keys are associated with virtual keys for process-level protection, then serviceability in sensitive environments is enhanced, but the complexity of key association and validation increases
Solution Approach 1:
The virtual key structure nests physical page keys within it, creating a hierarchical key association system. This nesting enables the system to provide enhanced serviceability in sensitive environments by allowing process-level control over memory access while managing the complexity of key associations through a structured nested organization rather than flat one-to-one mappings.
Data Source
AI summary
Embodiments of the present invention provide an approach for memory protection at a level of granularity above a “page” level (e.g., enhancing the protection provided by a memory key-based system). The approach further provides such a level of protection at a process or task level by associating the physical page key with a virtual key that corresponds to a particular process/task. When access to the data is requested for a particular process or task, it is determined if a protection bit for the data is set, and if the physical page keys and/or virtual keys submitted pursuant to the request match that previously stored for the data and process/task. If so, access to the data is allowed for the particular process/task.