Back to results
US 11,531,627 B2Granted
Secure storage isolation
AssigneeInternational Business Machines Corporation
InventorsJonathan D. Bradbury, Lisa Cranton Heller, Utz Bacher, Fadi Y. Busaba
Life of this patent
Estimating the term…
Abstract
An computer-implemented method according to examples includes receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system. The method further includes, responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check. The method further includes, responsive to determining that the requestor is a secure requestor, performing the authorization check.
Claims19
A method comprising:
- receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system;
- responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check;
- and
- responsive to determining that the requestor is a secure requestor, performing the authorization check, wherein the authorization check comprises a check, based at least in part on a zone security table, to verify that the page belongs to a secure domain that is trying to access the page, wherein the zone security table comprises a secure guest domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address.
1 more element
A system comprising:
- a memory comprising computer readable instructions;
- and
- a processing device for executing the computer readable instructions for performing a method comprising:
- receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system;
- responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check;
- and
- responsive to determining that the requestor is a secure requestor, performing the authorization check, wherein the authorization check comprises a check, based at least in part on a zone security table, to verify that the page belongs to a secure domain that is trying to access the page, wherein the zone security table comprises a secure guest domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address.
4 more elements
A computer program product comprising:
- a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising:
- receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system;
- responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check;
- and
- responsive to determining that the requestor is a secure requestor, performing the authorization check, wherein the authorization check comprises a check, based at least in part on a zone security table, to verify that the page belongs to a secure domain that is trying to access the page, wherein the zone security table comprises a secure guest domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address.
2 more elements
A computer-implemented method comprising:
- receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system;
- responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check;
- and
- responsive to determining that the requestor is a secure requestor, performing the authorization check,
- wherein the authorization check comprises a check, based at least in part on a zone security table, to verify that the page belongs to a secure domain that is trying to access the page, and a check to verify that a non-secure entity has not changed a host mapping of the page while the page is resident in the memory, wherein the zone security table comprises a secure guest domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address.
2 more elements
A computer program product comprising:
- a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising:
- receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system;
- responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check;
- and
- responsive to determining that the requestor is a secure requestor, performing the authorization check,
- wherein the authorization check comprises a check, based at least in part on a zone security table, to verify that the page belongs to a secure domain that is trying to access the page, and a check to verify that a non-secure entity has not changed a host mapping of the page while the page is resident in the memory, wherein the zone security table comprises a secure guest domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address.
3 more elements
Dependencies are inferred from the claim text.