Methods and apparatus for protecting domains of a device from unauthorized accesses

A data processing apparatus comprising:

• processing circuitry configured to perform processing functions in response to program instructions, said processing circuitry comprising a target domain, a source domain and a monitor, wherein said monitor is arranged to apply security credentials to said processing circuitry transitioning from said source domain to said target domain to enable said processing circuitry to perform functions in said target domain, and a trusted storage device for storing at least one entry call gateway and at least one exit call gateway, said entry call gateways comprising a transition instruction and entry access parameters restricting access of code to said target domain, and said exit call gateways comprising a transition instruction and exit access parameters restricting exit of the code from said source domain, said monitor being further arranged to:
• determine when an exit call gateway is stored in said trusted storage device in response to a transition instruction, and following determination that said exit call gateway is stored in said trusted storage device, suspending at least one access privilege to said source domain defined in said exit access parameters;
• determine when a target call gateway is stored in said trusted storage device in response to a transition instruction, and following determination that said target call gateway is stored in said trusted storage device, applying said security credentials to said processing circuitry, so that said processing circuitry can perform a target function in said target domain, said entry access parameters comprising said target function;
• and
• determine when said exit access parameters and/or said entry access parameters are not complied with, and following a determination that said exit access parameters and/or said entry access parameters are not complied, denying said processing circuitry to performing the target function in said target domain.

A computer program product comprising program code on non-transitory computer-readable medium that, when executed on a processor, cause the processor to protect a target domain and a source domain from an unauthorized context switch from said source domain to said target domain, including:

• identifying an exit call gateway comprising an exit transition instruction and at least one exit access parameter, said exit access parameters restricting exit of code from said source domain;
• identifying an entry call gateway corresponding to said exit call gateway, said entry call gateway comprising a transition instruction and at least one entry access parameter, said entry access parameters restricting access of the code to said target domain;
• determining that said exit access parameters and said entry access parameters are compatible with each other;
• and
• performing a context switch from said source domain to said target domain, when said exit access parameters and said entry access parameters are complied with, wherein performing said context switch from said source domain to said target domain comprises applying security credentials to the code transitioning from said source domain to said target domain to enable completion of a function and/or an access defined in said entry access parameters at said target domain;
• and
• denying said context switch from said source domain to said target domain when said exit access parameters and/or said entry access parameters are not complied with.