Providing access to data in a secure communication
The present disclosure is directed to preventing computer data from being usurped and exploited by individuals or organizations with nefarious intent. Methods and systems consistent with the present disclosure may store keys and keying data for each of a plurality of connections in separate memory locations. These memory locations may store data that maps a virtual address to a physical memory address associated with storing information relating to a secure connection. These separate memory locations may have a unique instance for each individual communication connection session, for example each transport layer security (TLS) connection may be assigned memory via logical addresses that are mapped to one or more physical memory addresses on a per-core basis. Such architectures decouple actual physical addresses that are used in conventional architectures that assign a single large continuous physical memory partition that may be accessed via commands that access physical memory addresses directly.
1. A method for securely accessing data, the method comprising:
storing a first set of translation data at a first data storage device separate from a system memory that is physically accessible only by a first processor of a multi-processor system, the first set of translation data associated with a first connection, wherein the first set of translation data maps a first virtual address to a first physical memory location that is only accessible to the first processor while servicing the first connection;
storing a second set of translation data in a second data storage device separate from the system memory that is physically accessible only by a second processor of the multi-processor system, the second set of translation data associated with a second connection, wherein the second set of translation data maps a second virtual address to a second physical memory location that is only accessible to the second processor while servicing the second connection;
accessing the first physical memory location that stores data associated with the first connection by the first processor, the first physical memory location accessed after the first processor translates the first virtual address to a first physical memory address using the first data storage device, wherein data stored at the first physical memory address is secured based on the first set of translation data being accessible only by the first processor;
accessing the second physical memory location that stores data associated with the second connection by the second processor, the second physical memory location accessed after the second processor translates the second virtual address to a second physical memory address using the second data storage device, wherein data stored at the second physical memory address is secured based on the second set of translation data being accessible only by the second processor;
securely communicating with a first destination associated with the first connection after accessing the first physical memory address; and
securely communicating with to a second destination associated with the second connection after accessing the second physical memory location.
2. The method of claim 1 , wherein the first virtual address and the second virtual address are a same virtual address that are respectively translated to the first physical memory address and the second physical memory address.
3. The method of claim 1 , wherein the first data storage device is associated with a first type of processor and a number of translation entries stored at the first data storage device correspond to the first type of processor.
4. The method of claim 1 , wherein program code associated with the first set of translation data is included in a set of firmware.
5. The method of claim 1 , wherein program code associated with the first set of translation data is included in a software driver.
6. The method of claim 1 , further comprising:
identifying that the first processor of the multi-processor system corresponds to a first type of processing core; and
assigning a number of translation entries to associate with the first set of translation data based on the identification that the first processor corresponds to the first type of processing core.
7. The method of claim 6 , further comprising identifying a size of the first data storage device, wherein the number of translation entries corresponds to the identified size of the first data storage device.
8. The method of claim 6 , further comprising identifying a data structure to associate with the first set of translation data.
9. The method of claim 1 , further comprising assigning a first entry of the first set of translation data to associate with the first virtual address with the first physical memory address, access permissions, and control permissions.
10. The method of claim 9 , wherein the first entry is also associated with a size.
11. The method of claim 1 , further comprising assigning a first entry of the first set of translation data to an access permission.
12. The method of claim 1 , further comprising assigning a first entry of the first set of translation data to a control permission.
13. A non-transitory computer-readable storage medium having embodied thereon a program executable by processor to perform a method for securely accessing data, the method comprising:
storing a first set of translation data at a first data storage device separate from a system memory that is physically accessible only by a first processor of a multi-processor system, the first set of translation data associated with a first connection, wherein the first set of translation data maps a first virtual address to a first physical memory location that is only accessible to the first processor while servicing the first connection;
storing a second set of translation data in a second data storage device separate from the system memory that is physically accessible only by a second processor of the multi-processor system, the second set of translation data associated with a second connection, wherein the second set of translation data maps a second virtual address to a second physical memory location that is only accessible to the second processor while servicing the second connection;
accessing the first physical memory location that stores data associated with the first connection by the first processor, the first physical memory location accessed after the first processor translates the first virtual address to a first physical memory address using the first data storage device, wherein data stored at the first physical memory address is secured based on the first set of translation data being accessible only by the first processor;
accessing the second physical memory location that stores data associated with the second connection by the second processor, the second physical memory location accessed after the second processor translates the second virtual address to a second physical memory address using the second data storage device, wherein data stored at the second physical memory address is secured based on the second set of translation data being accessible only by the second processor;
securely communicating with a first destination associated with the first connection after accessing the first physical memory address; and
securely communicating with a second destination associated with the second connection after accessing the second physical memory location.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the first virtual address and the second virtual address are a same address that are respectively translated to the first physical memory address and the second physical memory address.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the first data storage device is associated with a first type of processor and a number of translation entries stored at the first data storage device correspond to the first type of processor.
16. The non-transitory computer-readable storage medium of claim 13 , the program further executable to:
identify that the first processor of the multi-processor system corresponds to a first type of processing core; and
assign a number of translation entries to associate with the first set of translation data based on the identification that the first processor corresponds to the first type of processing core.
17. The non-transitory computer-readable storage medium of claim 16 , the program further executable to identify a size of the first data storage device, wherein the number of translation entries corresponds to the identified size of the first data storage device.
18. The non-transitory computer-readable storage medium of claim 16 , the program further executable to identify a data structure to associate with the first set of translation data.
19. An apparatus for securely accessing data in a multi-processor system, the apparatus comprising:
a first processor of that executes stored instructions;
a first storage device separate from a system memory that is physically accessible only by the first processor that stores a first set of translation data, the first set of translation data associated with a first connection from which data is sent and received, wherein:
the first processor securely accesses data at a first physical memory location that stores data associated with the first connection, the data securely accessed based on the first storage device only being accessible by the first processor, and
the first physical memory location is accessed after the first processor translates a first virtual address to a first physical memory address only accessible to the first processor while servicing the first connection;
a second processor that executes stored instructions; and
a second storage device separate from the system memory that is physically accessible only by the second processor that stores a second set of translation data, the second set of translation data associated with a second connection from which data is sent and received, wherein:
the second processor securely accesses data at a second physical memory location that stores data associated with the second connection based on the second storage device being accessible only by the second processor, and
the second physical memory location accessed after the second processor translates a second virtual address to a second physical memory address only accessible to the second processor while servicing the second connection.
20. The apparatus of claim 19 , further comprising a system memory that stores the stored instructions executed by the first processor and by the second processor.