US 11,899,593 B2Granted

Method and apparatus for detecting ATS-based DMA attack

AssigneeIntel Corporation

InventorPrzemyslaw Duda

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments are directed to providing a secure address translation service. An embodiment of a system includes a computer-readable memory for storage of data, the computer-readable memory comprising a first memory buffer and a second memory buffer, an attack discovery unit device comprising processing circuitry to perform operations, comprising, receiving a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA), and blocking a direct memory access in response to a determination of at least one of that the remote device has not obtained a valid address translation from a translation agent, or that the remote device has not obtained a valid translation for the target memory address from the translation agent.

Claims21

Dependent claims

An apparatus comprising:

a computer-readable memory for storage of data, the computer-readable memory comprising a first memory buffer and a second memory buffer;
an attack discovery unit device comprising processing circuitry to perform operations, comprising:
receiving a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA);
searching a first memory table for an address translation verified bus device (ATVBDE) entry that matches a bus device pair associated with the PCIe link and a second memory table for an entry that matches a bus concatenation of a requester ID (RID) and a translated address included in an Address Translation Services (ATS) completion message;
and
blocking a direct memory access in response to a determination of at least one of:
that the remote device has not obtained a valid address translation from a translation agent;
or that the remote device has not obtained a valid translation for the target memory address from the translation agent.

5 more elements

A non-transitory computer readable medium comprising instructions which, when executed by a processor, configure the processor to perform operations comprising:

receiving, in an attack discovery unit device, a direct memory access (DMA) request from a remote device via a Peripheral Component Interconnect Express (PCIe) link, the direct memory access (DMA) request comprising a host physical address and a header indicating that the target memory address has previously been translated to a host physical address (HPA);
searching a first memory table for an address translation verified bus device (ATVBDE) entry that matches a bus device pair associated with the PCIe link and a second memory table for an entry that matches a bus concatenation of a requester ID (RID) and a translated address included in an Address Translation Services (ATS) completion message;
and blocking a direct memory access in response to a determination of at least one of:
that the remote device has not obtained a valid address translation from a translation agent;
or that the remote device has not obtained a valid translation for the target memory address from the translation agent.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/557,363Filed 21 Dec 2021
Published: US 2022/0114107 A114 Apr 2022
Granted: 13 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

G06F 12/1081
Address translation: for peripheral access to main memory, e.g. direct memory access [DMA]
G06F 13/4295
On a serial bus, e.g. I2C bus, SPI bus: using an embedded synchronisation
G06F 12/0238
Free address space management: memory management in non-volatile memory, e.g. resistive RAM or ferroelectric memory
G06F 12/1072
Address translation: decentralised address translation, e.g. in distributed shared memory systems