# US 9,438,424 B2 · Methods, apparatus, and systems for secure demand paging and other paging operations for processor devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,424 B2
- Document ID: US9438424B2
- Status: Granted
- Kind: B2
- Application number: 14/458,592
- Filed: 2014-08-13
- Published: 2015-01-29
- Granted: 2016-09-06
- Earliest claimed: 2006-06-27
- Assignees: Texas Instruments Incorporated
- Applicants: Texas Instruments Incorporated
- Inventors: Steven Goss; Gregory Remy Philippe Conti; Narendar M. Shankar; Mehdi-Laurent Akkar; Aymeric Vial
- Web page: https://patentgrep.com/patent/US9438424B2

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/461: {Saving or restoring of program or task context}
- G06F 12/0246: {in block erasable memory, e.g. flash memory}
- G06F 12/145: {the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism}
- G06F 12/1483: {using an access-table, e.g. matrix or list}
- G06F 21/575: {Secure boot}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/102: Route integrity, e.g. using trusted paths
- G06F 12/08: in hierarchically structured memory systems, e.g. virtual memory systems
- G06F 2009/45583: {Memory management, e.g. access or allocation}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2212/171: Portable consumer electronics, e.g. mobile phone
- G06F 2212/402: Encrypted data
- G06F 2212/7201: Logical to physical mapping or translation of blocks or pages
- H04L 63/123: {received data contents, e.g. message integrity}
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

A secure demand paging system (1020) includes a processor (1030) operable for executing instructions, an internal memory (1034) for a first page in a first virtual machine context, an external memory (1024) for a second page in a second virtual machine context, and a security circuit (1038) coupled to the processor (1030) and to the internal memory (1034) for maintaining the first page secure in the internal memory (1034). The processor (1030) is operable to execute sets of instructions representing: a central controller (4210), an abort handler (4260) coupled to supply to the central controller (4210) at least one signal representing a page fault by an instruction in the processor (1030), a scavenger (4220) responsive to the central controller (4210) and operable to identify the first page as a page to free, a virtual machine context switcher (4230) responsive to the central controller (4210) to change from the first virtual machine context to the second virtual machine context; and a swapper manager (4240) operable to swap in the second page from the external memory (1024) with decryption and integrity check, to the internal memory (1034) in place of the first page.

## Claims

### Claim 1

A secure demand paging (SPD) system comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor is operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status;
selectively perform the page scavenging so that page wiping is included and a swap out of a modified wiped page is deferred; and
establish a queue identifying pages for which swap out is deferred; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 2 (depends on 1)

The system claimed in claim 1 wherein said microprocessor is operable to subsequently swap out pages in response to the queue identifying pages for which swap out is deferred.

### Claim 3

A secure demand paging (SDP) system comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor is operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
preform a virtual machine context switch to load a protected application, run the protected application, and execute the page scavenger; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 4 (depends on 3)

The system claimed in claim 3 wherein said processor is operable to selectively perform the page scavenging so that a swap out is included and a swap in is bypassed.

### Claim 5 (depends on 3)

The system claimed in claim 3 wherein said processor is operable to selectively perform the page scavenging so that page wiping is included and a swap out of a modified wiped page is deferred.

### Claim 6 (depends on 3)

The system claimed in claim 3 wherein the page scavenger includes a priority for wiping out a page.

### Claim 7 (depends on 6)

The system claimed in claim 6 wherein the page scavenger includes a subsequent page swapping out operation.

### Claim 8 (depends on 3)

The system claimed in claim 3 wherein said page scavenger is scheduled for an interval preceded by an interval for execution of the protected application.

### Claim 9 (depends on 3)

The system claimed in claim 3 wherein said microprocessor is operable to perform a first call to the page scavenger during a busier interval when the secure internal memory is full for paging purposes, and a second call to page scavenger during said at least one interval of lower activity status.

### Claim 10

A secure demand paging (SDP) system comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor is operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context activation during an interval of lower-activity status; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 11

A secure demand paging (SDP) system comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor is operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context deactivation during an interval of lower-activity status; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 12

A process for providing a secure demand paging (SDP) system comprising:
providing an external volatile memory;
providing a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status;
selectively perform page scavenging so that page wiping is included and a swap out of a modified wined page is deferred;
establish a queue identifying pages for which swap out is deferred; and
providing a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the pane scavenger for said at least one interval of lower-activity status.

### Claim 13 (depends on 12)

The process claimed in claim 12 wherein said processor is operable to subsequently swap out pages in response to the queue identifying pages for which swap out is deferred.

### Claim 14 (depends on 12)

The process claimed in claim 12 wherein the page scavenger includes a priority for wiping out a page.

### Claim 15 (depends on 14)

The process claimed in claim 14 wherein the page scavenger includes a subsequent page swapping out operation.

### Claim 16 (depends on 12)

The process claimed in claim 12 wherein said page scavenger is scheduled for an interval preceded by an interval for execution of the protected application.

### Claim 17

A process for providing a secure demand paging (SDP) system comprising:
providing an external volatile memory;
providing a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context switch to load a protected application, run the protected application, and execute the page scavenger; and
providing a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 18 (depends on 17)

The process in claim 17 wherein said processor is operable to selectively perform the page scavenging so that a swap out is included and a swap in is bypassed.

### Claim 19 (depends on 17)

The process claimed in claim 17 wherein said processor is operable to selectively perform the page scavenging so that page wiping is included and a swap out of a modified wiped page is deferred.

### Claim 20 (depends on 17)

The process claimed in claim 17 wherein said processor is operable to perform a first call to the page scavenger during a busier interval when the secure internal memory is full for paging purposes, and a second call to page scavenger during said at least one interval of lower activity status.

### Claim 21

A process for providing a secure demand paging (SDP) system comprising:
providing an external volatile memory;
providing a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context activation during an interval of lower-activity status; and
providing a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 22

A process for providing a secure demand paging (SDP) system comprising:
providing an external volatile memory;
providing a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context deactivation during an interval of lower-activity status; and
providing a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status.

### Claim 23

A communications apparatus, comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status;
selectively perform page scavenging so that pan wiping is included and a swap out of a modified wiped page is deferred; and
establish a queue identifying pages for which swap out is deferred; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status;
an antenna;
a transmitter and a receiver coupled to said antenna and to said microprocessor; and
a user interface coupled to said microprocessor.

### Claim 24 (depends on 23)

The communications apparatus in claim 23 wherein said processor is operable to selectively perform the page scavenging so that a swap out is included and a swap in is bypassed.

### Claim 25 (depends on 23)

The communications apparatus in claim 23 wherein said processor is operable to selectively perform the page scavenging so that page wiping is included and a swap out of a modified wiped page is deferred.

### Claim 26 (depends on 23)

The communications apparatus in claim 23 wherein said microprocessor is operable to subsequently swap out pages in response to the queue identifying pages for which swap out is deferred.

### Claim 27 (depends on 23)

The communications apparatus in claim 23 wherein the page scavenger includes a priority for wiping out a page.

### Claim 28 (depends on 27)

The communications apparatus in claim 27 wherein the page scavenger includes a subsequent page swapping out operation.

### Claim 29 (depends on 27)

The communications apparatus in claim 27 wherein said page scavenger is scheduled for an interval preceded by an interval for execution of the protected application.

### Claim 30

A communications apparatus, comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context switch to load a protected application, run the protected application, and execute the page scavenger; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status;
an antenna;
a transmitter and a receiver coupled to said antenna and to said microprocessor; and
a user interface coupled to said microprocessor.

### Claim 31 (depends on 30)

The communications apparatus in claim 30 wherein said processor is operable to perform a first call to the page scavenger during a busier interval when the secure internal memory is full for paging purposes, and a second call to page scavenger during said at least one interval of lower activity status.

### Claim 32

A communications apparatus, comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context activation during an interval of lower-activity status; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status;
an antenna;
a transmitter and a receiver coupled to said antenna and to said microprocessor; and
a user interface coupled to said microprocessor.

### Claim 33

A communications apparatus, comprising:
an external volatile memory;
a microprocessor coupled to said external volatile memory, said microprocessor having a secure internal memory having a physical address space, and said microprocessor operable to:
execute at least one protected application in the secure internal memory;
execute a client application at intervals and also have at least one interval of lower-activity status; and
perform a virtual machine context deactivation during an interval of lower-activity status; and
a non-volatile memory storing a coded physical representation of operations accessible by said microprocessor including a representation of an SDP protected application including a page scavenger, and an operation to schedule the page scavenger for said at least one interval of lower-activity status;
an antenna;
a transmitter and a receiver coupled to said antenna and to said microprocessor; and
a user interface coupled to said microprocessor.