# US 12,602,491 B2 · Method and system for using secure remote direct memory access (RDMA) system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,491 B2 - Document ID: US12602491B2 - Status: Granted - Kind: B2 - Application number: 18/522,677 - Filed: 2023-11-29 - Published: 2024-05-30 - Granted: 2026-04-14 - Earliest claimed: 2022-11-30 - Assignees: Lockheed Martin Corporation - Applicants: Lockheed Martin Corporation - Inventors: Robert W. Hale; Kyle Alan Borowski; Mathew Lee VanDerPol - Web page: https://patentgrep.com/patent/US12602491B2 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - G06F 13/4221: {being an input/output bus, e.g. ISA bus, EISA bus, PCI bus, SCSI bus} - G06F 2213/0026: PCI express - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments provide a method executed by a secure remote direct memory (RDMA) system. The method includes detecting, by the secure RDMA system, a connection request to create an encrypted connection between a first computing device and a second computing device. An encryption key is shared between the first computing device and the second computing device. In response to sharing the encryption key, accessing a plurality of images of a plurality of memories of the second computing device. The plurality of images of the plurality of memories includes memory addresses. The method includes receiving an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories. The method includes creating an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories, in response to the access request. ## Claims ### Claim 1 A computer-implemented method executed by a secure remote direct memory access (RDMA) system, the method comprising: detecting, by the secure RDMA system, a connection request to create an encrypted connection between a first computing device and a second computing device, wherein an encryption key is shared between the first computing device and the second computing device, the secure RDMA system is configured in a single board chip as part of a single hardware security controller (HSC), and the single HSC is configured to establish encrypted connections with a plurality of external systems to read memory information from the plurality of external systems; in response to sharing the encryption key, accessing a plurality of images of a plurality of memories of the second computing device, wherein the plurality of images of the plurality of memories comprises memory addresses; receiving an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories; in response to the access request, creating an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the connection request comprises a read command, a write-to command, a change command to change memory data in a plurality of ranges of memory addresses, and an access command to access the memory data from a plurality of ranges of memory addresses. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising creating any of a media access control security (MACsec) encrypted connection and an internet protocol (IP) encrypted connection corresponding to the encrypted connection between the first computing device and the second computing device. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the secure RDMA system comprises any of a hardware security controller system and a software security controller system. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the memory information from the range of memory addresses is encrypted to share through the encrypted tunnel from the second computing device to the first computing device, and the memory information is shared in a form selected from any of cryptographic text frames and plain text frames. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the secure RDMA assigns the first computing device as a host computing device connected to a peripheral component interconnect Express (PCIe) connection bus. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the access request specifying the range of memory addresses comprises data frames in a format selected from any of ethernet type access request, media access control security (MACsec) type access request, and internet protocol type access request. ### Claim 8 A system, comprising: a security remote direct memory access (RDMA) system configured in a Field Programmable Gate Array (FPGA) system, the secure RDMA comprising a plurality of processors, operably coupled with one or more memories, the secure RDMA system is configured in a single board chip as part of a single hardware security controller (HSC), and the single HSC is configured to establish encrypted connections with a plurality of external systems to read memory information from the plurality of external systems, and a processor of the plurality of processors configured to: detect a connection request to create an encrypted connection between a first computing device and a second computing device, wherein an encryption key is shared between the first computing device and the second computing device; in response to sharing the encryption key, access a plurality of images of a plurality of memories of the second computing device, wherein the plurality of images of the plurality of memories comprises memory addresses; receive an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories; in response to the access request, create an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories. ### Claim 9 (depends on 8) The system of claim 8, wherein the connection request comprises a read command, a write-to command, a change command to change memory data in a plurality of ranges of memory addresses, and an access command to access the memory data from a plurality of ranges of memory addresses. ### Claim 10 (depends on 8) The system of claim 8, wherein the secure RDMA is configured to create any of a media access control security (MACsec) encrypted connection and an internet protocol (IP) encrypted connection corresponding to the encrypted connection between the first computing device and the second computing device. ### Claim 11 (depends on 8) The system of claim 8, wherein the memory information from the range of memory addresses is encrypted to share through the encrypted tunnel from the second computing device to the first computing device, and the memory information is shared in a form selected from any of cryptographic text frames and plain text frames. ### Claim 12 (depends on 8) The system of claim 8, wherein the secure RDMA assigns the first computing device as a host computing device connected to a peripheral component interconnect Express (PCIe) connection bus. ### Claim 13 (depends on 8) The system of claim 8, wherein the access request specifying the range of memory addresses comprises data frames in a format selected from any of ethernet type access request, media access control security (MACsec) type access request, and internet protocol type access request. ### Claim 14 A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to: detect, by a secure RDMA system configured in a single board computer chip of a Field Programmable Gate Array (FPGA) system, a connection request to create an encrypted connection between a first computing device and a second computing device, wherein an encryption key is shared between the first computing device and the second computing device, the secure RDMA system is configured in a single board chip as part of a single hardware security controller (HSC), and the single HSC is configured to establish encrypted connections with a plurality of external systems to read memory information from the plurality of external systems; in response to sharing the encryption key, access a plurality of images of a plurality of memories of the second computing device, wherein the plurality of images of the plurality of memories comprises memory addresses; receive an access request specifying a range of memory addresses from the first computing device based on accessing the plurality of images of the plurality of memories; in response to the access request, create an encrypted tunnel between the first computing device and the second computing device to share memory information based on the range of memory addresses of the plurality of memories. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the connection request comprises a read command, a write-to command, a change command to change memory data in a plurality of ranges of memory addresses, and an access command to access the memory data from a plurality of ranges of memory addresses. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the processor is further configured to create any of a media access control security (MACsec) encrypted connection and an internet protocol (IP) encrypted connection corresponding to the encrypted connection between the first computing device and the second computing device. ### Claim 17 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the memory information from the range of memory addresses is encrypted to share through the encrypted tunnel from the second computing device to the first computing device, and the memory information is shared in a form selected from any of cryptographic text frames and plain text frames. ### Claim 18 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the access request specifying the range of memory addresses comprises data frames in a format selected from any of ethernet type access request, media access control security (MACsec) type access request, and internet protocol type access request.