Secure direct memory access through system controllers and similar hardware devices
AssigneeHewlett-Packard Development Company, L.P.
InventorChris D. Hyser
Life of this patent
Estimating the term…
Abstract
A method and system for providing secure, direct access to computer system resources, such as system memory, by a non-trusted processing entity running in an unprivileged state that request access to the resource through a device that directly accesses the resource. The device includes access-right-checking logic and is configured to verify access rights of non-trusted processing entities that attempt to access the resource through the device. By checking access rights, the device ensures that non-trusted processing entities access only those particular portions of the resource authorized for access by the secure kernel.
Claims17
A method, within a computer system containing one or more CPUs, for securing direct access, by a non-trusted processing entity external to the one or more CPUs, to a resource through a system bus, the method comprising:
- providing a bridge device external to the one or more CPUs that includes access-authorization logic and that interconnects the non-trusted processing entity external to the one or more CPUs with the system bus and, through the system bus, to the resource;
- upon receiving, by the bridge device, a resource-access request from the non-trusted processing entity external to the one or more CPUs specifying a portion of the resource, using the access-authorization logic to determine whether or not the access request is authorized;
- when bridge device determines that the non-trusted processing entity external to the one or more CPUs is authorized to access the portion of the resource, providing access to the portion of the resource to the non-trusted processing entity external to the one or more CPUs;
- and
- when the bridge device determines that the non-trusted processing entity external to the one or more CPUs is not authorized to access the portion of the resource, returning to the non-trusted processing entity external to the one or more CPUs an access error.
A computer system that includes:
- a non-trusted processing entity external to the one or more CPUs;
- a resource connected to a system bus;
- a bridge device external to the one or more CPUs that includes access-authorization logic and that interconnects the non-trusted processing entity external to the one or more CPUs with the system bus and, through the system bus, to the resource, the bridge device, upon receiving a resource-access request from the non-trusted processing entity external to the one or more CPUs that specifies a portion of the resource, using the access-authorization logic to determine whether or not the access request is authorized;
- and
- a kernel that authorizes access by the non-trusted processing entity external to the one or more CPUs to portions of the resource.
Dependencies are inferred from the claim text.