# US 10,310,990 B2 · Direct memory access encryption with application provided keys

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,310,990 B2
- Document ID: US10310990B2
- Status: Granted
- Kind: B2
- Application number: 15/192,493
- Filed: 2016-06-24
- Published: 2017-12-28
- Granted: 2019-06-04
- Earliest claimed: 2016-06-24
- Assignees: Hewlett Packard Enterprise Development LP
- Applicants: Hewlett Packard Enterprise Development LP
- Inventors: Adrian Shaw; Geoffrey Ndu; Fraser John Dickin
- Web page: https://patentgrep.com/patent/US10310990B2

## CPC

- G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)}
- G06F 12/1466: {Key-lock mechanism}
- G06F 13/28: using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence)
- G06F 2212/1052: Security improvement
- G06F 2212/402: Encrypted data
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one example in accordance with the present disclosure, a method may include retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access and determining, at the MMU, a peripheral that is the intended recipient of the encrypted data. The method may also include accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application and decrypting, at the MMU, the encrypted data using the application key and transmitting the decrypted data to the peripheral.

## Claims

### Claim 1

A method for direct memory access encryption with application provided keys comprising:
retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access;
determining, at the MMU, a peripheral that is the intended recipient of the encrypted data, wherein the peripheral attached to a computer system;
accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application;
decrypting, at the MMU, the encrypted data using the application key;
transmitting the decrypted data to the peripheral;
transmitting, via an operating system of the computer system, an encrypted configuration request including a security key corresponding to the peripheral, a first identity of a hardware management unit and a second identity of the peripheral;
decrypting, at the hardware management unit, the encrypted configuration request;
signing, at the hardware management unit, a response message to the application comprising a matching security key; and
transmitting, via the operating system, the response message to the application.

### Claim 2 (depends on 1)

The method of claim 1, wherein the MMU includes a hardware encryption/decryption unit and the hardware encryption/decryption unit decrypts the encrypted data.

### Claim 3 (depends on 1)

The method of claim 1, wherein a plurality of application keys including the application key is stored in a memory region of the MMU.

### Claim 4 (depends on 1)

The method of claim 1, wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the MMU and a second region of the memory accessed by a processor of the computer system.

### Claim 5 (depends on 4)

The method of claim 4, comprising:
creating, by the operating system, a mapping between an address range of the memory and the peripheral.

### Claim 6 (depends on 4)

The method of claim 4, comprising:
creating, by the hardware management unit, an address range mapping for the application key; and
storing the address range mapping in a key region table in a secure portion of memory.

### Claim 7

A system for direct memory access encryption with application provided keys comprising:
a non-transitory memory storing instructions;
a processor configured to execute the instructions to cause the system to:
access, at a memory management unit (MMU), data from a peripheral attached to a computer system;
determine, at the MMU, an application that is the intended recipient of the data, wherein the application executes on the computer system;
retrieve an application key used for transmission between the application and the peripheral;
encrypt, at the MMU, the data using the application key; and
transmit the encrypted data to a memory of the computer system; and
a hardware component to:
receive, from an operating system of the computer system, an encrypted configuration request including a security key corresponding to the peripheral, a first identity of the hardware component and a second identity of the peripheral;
decrypt the encrypted configuration request; and
sign a response message to the application comprising a matching security key.

### Claim 8 (depends on 7)

The system of claim 7, wherein the MMU includes a hardware encryption/decryption unit and the encrypted data is encrypted by the hardware encryption/decryption unit.

### Claim 9 (depends on 7)

The system of claim 7, wherein a plurality of application keys including the application key is stored in a memory region of the MMU.

### Claim 10 (depends on 7)

The system of claim 7, wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the MMU and a second region of the memory accessed by a processor of the computer system.

### Claim 11 (depends on 7)

The system of claim 7, wherein the hardware component is further to:
create an address range mapping for the application key; and
store the address range mapping in a key region table.

### Claim 12 (depends on 7)

The system of claim 7, wherein the processor is configured to execute the instructions to cause the system to create, by the operating system, a mapping between an address range of the memory and the peripheral.

### Claim 13

A system for direct memory access encryption with application provided keys comprising:
a processor to:
encrypt data for a peripheral attached to the system, and
transmit the encrypted data to a memory of the system; and
a first hardware component, operably coupled to the processor, to:
retrieve the encrypted data from the memory via direct memory access,
access an application key used for transmission between an application and the peripheral,
decrypt the encrypted data using the application key, and
transmit the decrypted data to the peripheral; and
a second hardware component coupled to the first hardware component to:
receive an encrypted configuration request including a security key corresponding to the peripheral, a first identity of the second hardware component and a second identity of the peripheral;
decrypt the encrypted configuration request;
sign a response message to the application comprising a matching security key; and
transmit the response message to the application.

### Claim 14 (depends on 13)

The system of claim 13, wherein the first hardware component is further to:
access, via an operating system, a region of the memory accessed by the processor.

### Claim 15 (depends on 13)

The system of claim 13 wherein the first hardware component comprises an encryption/decryption hardware unit to decrypt the encrypted data.

### Claim 16 (depends on 13)

The system of claim 13 wherein the first hardware component is further to:
access a memory region of the first hardware component storing a plurality of application keys including the application key.

### Claim 17 (depends on 13)

The system of claim 13, wherein the processor is further to:
create a mapping between an address range of the memory and the peripheral.

### Claim 18 (depends on 17)

The system of claim 17, wherein the second hardware component is further to:
create an address range mapping for the application key; and
store the address range mapping in a key region table.

### Claim 19 (depends on 17)

The system of claim 17, wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the first hardware component and a second region of the memory accessed by a processor of the computer system.