Parameter signature for realm security configuration parameters

A data processing method comprising:

• performing data processing in response to one or more software processes;
• and
• enforcing ownership rights for a plurality of memory regions based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of the software processes, said owner realm having a right to exclude other realms from accessing data stored within said given memory region;
• and
• controlling operation of a given realm based on security configuration parameters associated with the given realm;
• in which:
• on activation of a target realm to enable the target realm to be processed, the method comprises:
• detecting whether a parameter signature derived from the security configuration parameters established for the target realm by a parent realm in response to a request to create the target realm matches an expected signature provided to the parent realm in the request to create the target realm;
• and
• in response to detecting a mismatch between the parameter signature and the expected signature, applying an activation restriction to the target realm to prevent the activation of the target realm or prevent correct functioning of the target realm following activation.

A non-transitory storage medium storing a computer program for controlling a host data processing apparatus to provide an instruction execution environment, comprising:

• memory access program logic to control access to a plurality of memory regions of a simulated memory address space based on ownership information defining, for a given memory region, an owner realm specified from among a plurality of realms, each realm corresponding to at least a portion of at least one of a plurality of software processes executed in the instruction execution environment, said owner realm having a right to exclude other realms from accessing data stored within said given memory region;
• and
• realm management program logic to control operation of a given realm based on security configuration parameters associated with the given realm;
• in which:
• on activation of a target realm to enable the target realm to be processed, the realm management program logic is configured to:
• detect whether a parameter signature derived from the security configuration parameters established for the target realm by a parent realm in response to a request to create the target realm matches an expected signature provided to the parent realm in the request to create the target realm;
• and
• in response to detecting a mismatch between the parameter signature and the expected signature, apply an activation restriction to the target realm to prevent the activation of the target realm or prevent correct functioning of the target realm following activation.