Firmware guard extension with converged defense engine
A system for data protection, comprising an address mapping state machine configured to receive address data and protection data and to generate runtime address data, a firmware extension table coupled to a plurality of adders that are configured to receive data derived from the runtime address data and to output mapped runtime address data and a plurality of external components configured to receive the mapped runtime address data and to utilize the mapped runtime address data for one or more predetermined functions.
1 . A method for data protection, comprising:
receiving address data and protection data at a dynamic address map enclave [DAME] state machine;
generating runtime address data;
receiving data derived from the runtime address data at a firmware extension table coupled to a plurality of adders;
outputting mapped runtime address data;
receiving the mapped runtime address data at a plurality of external components;
utilizing the mapped runtime address data for one or more predetermined functions; and
remapping a converged defense engine domain memory with pre-map offsets during OS boot to OS runtime memory.
2 . The method of claim 1 further comprising generating memory domain protection type data for use with the runtime address data.
3 . The method of claim 1 further comprising generating isolation policy data for use with the runtime address data.
4 . The method of claim 1 further comprising generating an output to an isolation map.
5 . The method of claim 1 further comprising providing isolation map data to the mapped runtime address data.
6 . The method of claim 1 further comprising:
generating an output to an isolation map; and
providing isolation map data to the mapped runtime address data as a function of an output from an associative set metadata system.
7 . The method of claim 1 further comprising generating indexed address data.
8 . The method of claim 1 further comprising receiving an event queue entry and mapping the event queue entry to a vulnerability.
9 . The method of claim 1 further comprising processing entries for a queue entry mapping to an address range of an index table.
10 . A system for data protection comprising:
one or more processors having code stored in a working memory that cause the one or more processors, when executed, to perform functions of:
receiving address data and protection data at a dynamic address map enclave [DAME] state machine;
generating runtime address data;
receiving data derived from the runtime address data at a firmware extension table coupled to a plurality of adders;
outputting mapped runtime address data;
receiving the mapped runtime address data at a plurality of external components;
utilizing the mapped runtime address data for one or more predetermined functions; and
remapping a converged defense engine domain memory with pre-map offsets during OS boot to OS runtime memory.
11 . The system of claim 10 wherein the code causes the one or more processors to perform the function of generating memory domain protection type data for use with the runtime address data.
12 . The system of claim 10 wherein the code causes the one or more processors to perform the function of generating isolation policy data for use with the runtime address data.
13 . The system of claim 10 wherein the code causes the one or more processors to perform the function of generating an output to an isolation map.
14 . The system of claim 10 wherein the code causes the one or more processors to perform the function of providing isolation map data to the mapped runtime address data.
15 . The system of claim 10 wherein the code causes the one or more processors to perform the function of:
generating an output to an isolation map; and
providing isolation map data to the mapped runtime address data as a function of an output from an associative set metadata system.
16 . The system of claim 10 wherein the code causes the one or more processors to perform the function of generating indexed address data.
17 . The system of claim 10 wherein the code causes the one or more processors to perform the function of receiving an event queue entry and mapping the event queue entry to a vulnerability.
18 . The system of claim 10 wherein the code causes the one or more processors to perform the function of processing entries for a queue entry mapping to an address range of an index table.
19 . A method for data protection, comprising:
receiving address data and protection data at a dynamic address map enclave [DAME] state machine;
generating runtime address data;
receiving data derived from the runtime address data at a firmware extension table coupled to a plurality of adders;
outputting mapped runtime address data;
receiving the mapped runtime address data at a plurality of external components;
utilizing the mapped runtime address data for one or more predetermined functions;
remapping a converged defense engine domain memory with pre-map offsets during OS boot to OS runtime memory;
generating isolation policy data for use with the runtime address data; and
generating an output to an isolation map.
20 . The method of claim 19 further comprising providing isolation map data to the mapped runtime address data.