Access to memory region including confidential information
Embodiments herein relate to accessing a memory region including confidential information. A memory request from a process may be received. The memory request may include a process ID (PID) of the process, a requested memory address, and a requested access type. The memory request may be compared to a permission set associated with a memory region including the confidential information. Access to the memory region by the process may be controlled based on the comparison.
1. A device comprising:
a hardware permission module to receive a memory request from a process, the memory request including a process ID (PID) of the process, a requested memory address, a requested access type, and a requested purpose to indicate how confidential information at the requested memory address is to be used, wherein
the hardware permission module compares the memory request to a permission set associated with a memory region storing the confidential information,
the permission set includes one or more allowed PIDs, a memory address range, one or more allowed access types associated with the memory region, and one or more allowed purposes,
the access types include at least one of read, write, or reference types,
the reference type relates to providing a pointer to the requested memory address,
the hardware permission module includes a purpose module to compare the requested purpose to the one or more allowed purposes, and
the hardware permission module controls access to the memory region by the process based on the comparisons of the PID, address, access type, and hardware permission modules.
2. The device of claim 1 , wherein the hardware permission module includes,
a PID module to compare the PID of the process to the one or more allowed PIDs;
an address module to compare the requested memory address to the memory address range; and
an access type module to compare the requested access type to the one or more allowed access types.
3. The device of claim 2 , wherein,
the hardware permission module is to assert a miss signal if at least one of 1) the PID module indicates that the one or more allowed PIDs does not include the PID of process, or ii) the address module indicates that the memory address range does not include the requested memory address, and
the hardware permission module is to assert a fault signal if the access type module indicated that the one or more allowed access types does not include the requested access type.
4. The device of claim 1 , wherein,
the memory request further includes a user ID (UID) field to identify at least one of a type of user and an identity of the user, and
the permission set includes a plurality of instances of part of the permission set for the memory region, each of the instances to be associated with one of a plurality of UIDs.
5. The device of claim 1 , further comprising:
an audit module to generate an audit log if the access type module determines that the one or more allowed access types does not include the requested access type, wherein
the audit log includes at least one of the PID of the process, the requested memory address, the requested access type, a user ID (UID), the requested purpose, a number of failed access attempts, or a timestamp of the one or more failed access attempts.
6. The device of claim 1 , further comprising:
an action module to carry out an action if the access type module determines that the one or more allowed access types does not include the requested access type, wherein
the action includes at least one of doing nothing, erasing a value at the requested memory address, erasing all values at the memory region, or generating an interrupt, and
the interrupt at least one of blocks access to and halts operation of a functionality of the device.
7. A system, comprising:
a permission module to receive a memory request from a process, the memory request including a process ID (PID) of the process, a requested memory address, a requested access type, and a requested purpose to indicate how confidential information at the requested memory address is to be used, wherein
the permission module compares the memory request to a permission set associated with a memory region storing the confidential information,
the permission set includes one or more allowed PIDs, a memory address range, one or more allowed access types associated with the memory region, and one or more allowed purposes,
the access types include at least one of read, write, or reference types,
the reference type relates to providing a pointer to the requested memory address,
the permission module includes a purpose module to compare the requested purpose to the one or more allowed purposes, and
the permission module controls access to the memory region by the process based on the comparisons of the PID, address, access type, and permission modules;
a memory including a plurality of memory regions, the permission module corresponding to one of the memory regions;
a processor to output the request; and
a memory management unit (MMU) to transmit the request to the permission module.
8. The system of claim 7 , wherein the permission module includes,
a PID module to compare the PID of the process to the one or more allowed PIDs;
an address module to compare the requested memory address to the memory address range; and
an access type module to compare the requested access type to the one or more allowed access types.
9. The system of claim 8 , wherein,
the permission module is to assert a miss signal if at least one of i) the PID module indicates that the one or more allowed PIDs does not include the PID of process, or ii) the address module indicates that the memory address range does not include the requested memory address, and
the permission module is to assert a fault signal if the access type module indicates that the one or more allowed access types does not include the requested access type.
10. The system of claim 9 , further comprising a plurality of permission modules, wherein,
each of the permission modules include separate permission sets associated with one of the memory regions,
the system asserts an action signal only if all of the permission modules assert the miss signal,
the system asserts an audit signal only if all the of the permission modules assert the fault signal, and
the system asserts an access control signal to grant the processor access to the memory, if at least one of the permission modules allows access.
11. The system of claim 10 , wherein,
the MMU receives a plurality of memory requests, and
the MMU one of i) transmits all of the memory requests, or ii) only the memory requests related to the memory regions associated with at least one of the permission modules.
12. A method for memory access, comprising:
receiving a memory request from a process, the memory request including a process ID (PID) of the process, a requested memory address, a requested access type, and a requested purpose to indicate how confidential information at the requested memory address is to be used;
comparing the memory request to a permission set associated with a memory region storing the confidential information, the permission set including one or more allowed PIDs, a memory address range, one or more allowed access types associated with the memory region, and one or more allowed purposes, and wherein:
the access types include at least one of read, write, or reference types, and
the reference type relates to providing a pointer to the requested memory address; and
controlling access to the memory region by the process based on the comparisons of the PID, address, access type, and allowed purposes.
13. The method of claim 12 , further comprising:
generating an action if at least one of i) the one or more allowed PIDs does not include the PID of the process, or ii) the allowed address range does not include the requested address; and
generating an audit log if the one or more allowed access types does not include the requested access type.
14. A non-transitory computer-readable storage medium storing instructions that, if executed by a processor of a device, cause the processor to:
receive a memory request from a process, the memory request including a process ID (PID) of the process, a requested memory address, a requested access type, and a requested purpose to indicate how confidential information at the requested memory address is to be used;
compare the memory request to a permission set associated with a memory region storing the confidential information, the permission set including one or more allowed PIDs, a memory address range, one or more allowed access types associated with the memory region, and one or more allowed purposes, and wherein:
the access types include at least one of read, write, or reference types, and
the reference type relates to providing a pointer to the requested memory address; and
control access to the memory region by the process based on the comparisons of the PID, address, access type, and allowed purposes.
15. The non-transitory computer-readable storage medium of claim 14 , further comprising instructions that, if executed by the processor, cause the processor to:
at least one of generate an audit log and carry out an action if at least one of i) the one or more allowed PIDs does not include the PID of the process, ii) the allowed address range does not include the requested address, or iii) the one or more allowed access types does not include the requested access type, wherein
the audit log includes at least one of the PID of the process, the requested memory address, the requested access type, a user ID (UID), a requested purpose, a number of failed access attempts, or a timestamp of the one or more failed access attempts, and
the action includes at least one of doing nothing, erasing a value at the requested memory address, erasing all values at the memory region, or generating an interrupt.