ENHANCED SECURITY FOR ACCESSING VIRTUAL MEMORY

• US 20140189881A1
• Filed: 12/31/2012
• Published: 07/03/2014
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Lindsay, Ronnie
• Granted Patent: US 8,935,800 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 12/145 the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/50 Control mechanisms for virtual memory, cache or TLB

Abstract

A disclosed method includes obtaining a physical address corresponding to a virtual address responsive to detecting a virtual address associated with a memory access instruction and, responsive to identifying a memory page associated with the physical address as a sensitive memory page, evaluating sensitive access information associated with the memory page. If the sensitive access information satisfies a sensitive access criteria, invoking a sensitive access handler to control execution of the memory access instruction.

Claims

1. A method, comprising:

obtaining a physical address corresponding to a virtual address associated with a memory access instruction; and

identifying a memory page associated with the physical address as a sensitive memory page;

evaluating sensitive access information associated with the memory page; and

invoking a sensitive access handler to control execution of the memory access instruction in response to the sensitive access information satisfying a sensitive access criteria.

2. The method of claim 1, wherein identifying the memory page as a sensitive memory page includes determining a state of a sensitive access enable bit associated with the memory page.

3. The method of claim 2, wherein the sensitive access information includes recency information indicative of a most recent access of the memory page and wherein the sensitive access criteria include a recency criteria specifying a threshold recency, where the recency criteria is satisfied if the recency parameter indicates a most recent access of the memory page occurred less recently than the threshold recency.

4. The method of claim 3, wherein the recency criteria and the recency threshold are specified in terms of clock cycles.

5. The method of claim 3, further comprising setting a recency bit associated with the memory page to indicate the recency of the most recent access relative to the specified grace period.

6. The method of claim 1, further comprising setting the sensitive access enable bit based on an information characteristic of the memory page, wherein the information characteristic is indicative of a characteristic of information stored on the memory page.

7. The method of claim 6, wherein the information characteristic indicates that information stored on the memory page includes personally identifying information.

8. The method of claim 6, wherein the information characteristic indicates that information stored on the memory page includes personal financial information.

9. The method of claim 6, wherein the information characteristic indicates that information stored on the memory page accesses network configuration information.

10. The method of claim 6, wherein the information characteristic indicates that information stored on the memory page accesses execution context information.

11. The method of claim 6, wherein the information characteristic indicates that information stored on the memory page includes protection level information.

12. A processor, comprising:

a translation lookaside buffer to generate a physical address corresponding to a virtual address in a memory access instruction;

a memory management unit to invoke a sensitive access handler to control execution of the memory access instruction responsive to determining that physical address is associated with a memory page satisfying sensitive access criteria;

storage to store a page table including page table entries, wherein a page table entry indicates;

physical addresses associated with a corresponding memory page; and

page status information including sensitive access data.

13. The processor of claim 12, wherein the sensitive access criteria are met when a sensitive access enable bit and a sensitive access recency bit associated with the memory page are asserted.

14. The processor of claim 12, sensitive access enable bit is asserted under control of a sensitive access policy stored in storage.

15. The processor of claim 12, wherein the sensitive access recency bit is indicative of whether a recency of a most recent access of the memory page exceeds a threshold recency.

16. A computer system, comprising:

a processor including a memory management unit to invoke a sensitive access handler to control execution of a memory access instruction responsive to determining that a physical address associated with the memory access instruction is associated with a memory page satisfying sensitive access criteria;

a touchscreen controller to communicate with a touchscreen display;

a solid state drive;

a storage medium to store;

a page table including a page table entry indicating;

physical addresses associated with a corresponding memory page; and

page status information including sensitive access data; and

resume module instruction to reduce usage of the solid state drive during transition to a power conservation state.

17. The system of claim 16, wherein the sensitive access handler evaluates execution environment characteristics to decide whether to permit the access to the memory page.

18. The system of claim 16, wherein the execution environment characteristics include characteristics indicative of an application program that initiated the access to the memory page.

19. The system of claim 16, wherein the execution environment characteristics include characteristics indicative of an identity of a user device that initiated the access to the memory page.

20. The system of claim 16, wherein the execution environment characteristics include characteristics indicative of a network and protocol associated with the user device.