Method and system for memory protection and security using credentials

A computer-implemented system for protecting a memory, said system comprising:

• a memory section with privileged and non-privileged sections;
• a host gateway (HG) to generate a capability credential;
• a device controller (DC) to append said credential to data transmitted to said memory;
• and
• at least one IO device enabled to do direct memory access (DMA) transactions with said memory.

A computer software product, including a computer-readable medium in which computer program instructions are stored, which instructions, when read by a computer, cause the computer to perform a method for protecting a memory, said method comprising:

• responsive to a direct memory access (DMA) request received from a consumer for a transaction of data from an IO device to said memory, said request including an IO command and a capability (CAP), generating a cryptographically signed capability (CAPB);
• forming a credential from CAP and CAPB;
• appending said credential to said IO command;
• configuring said IO device according to said credential and said IO command;
• transmitting said data from said IO device to the memory;
• and
• prior to allowing execution of said DMA, authenticating that said credential is valid.