Back to results
US 7,624,242 B2Granted
Operating system agnostic sharing of proteced memory using memory identifiers
AssigneeIntel Corporation
InventorsUday Savagaonkar, Ravi Sahita, Hormuzd Khosravi, Priya Rajagopal
Life of this patent
Estimating the term…
Abstract
An embodiment of the present invention is a technique to protect memory. A memory identifiers storage stores memory identifiers associated with protected components. The memory identifiers include exclusive memory identifiers and shared memory identifiers. The memory identifier storage is protected from access by a host operating system. A memory identifier management service (MMS) manages the memory identifiers. The MMS resides in a protected environment. An access control enforcer (ACE) enforces an access control policy with the memory identifiers.
Claims30
An apparatus comprising:
- a memory identifier storage to store memory identifiers associated with protected components, the memory identifiers including exclusive memory identifiers and shared memory identifiers, the memory identifier storage being protected from access by a host operating system, the memory identifier storage comprising:
- a per-page memory identifier table (PMT) to store memory identifiers associated with physical memory pages,
- an exclusive memory identifier book-keeping memory to maintain state information for each of the exclusive memory identifiers, and
- a shared memory identifier book-keeping memory to store access control information and credential requirements for the shared memory identifiers;
- a memory identifier management service (MMS) coupled to the memory identifier storage to manage the memory identifiers, the MMS residing in a protected environment, the MMS comprising:
- a registration agent to assign an exclusive memory identifier to a registering component and to assign a shared memory identifier to a registered component upon receiving a request having a unique name and credential requirements from the registered component, and
- a shared access processor coupled to the registration agent to process a request from a requestor to access the shared memory identifier using name and credentials provided by the requestor;
- and
- an access control enforcer (ACE) coupled to the MMS and the memory identifier storage to enforce an access control policy with the memory identifiers.
6 more elements
A method comprising:
- storing memory identifiers associated with protected components in a memory identifier storage, the memory identifiers including exclusive memory identifiers and shared memory identifiers, the memory identifier storage being protected from access by a host operating system, storing the memory identifiers comprising:
- storing memory identifiers associated with physical memory pages in a per-page memory identifier table (PMT),
- maintaining state information for each of the exclusive memory identifiers in an exclusive memory identifier book-keeping memory, and
- storing access control information and credential requirements for the shared memory identifiers in a shared memory identifier book-keeping memory;
- managing the memory identifiers using a memory identifier management service (MMS), the MMS residing in a protected environment, managing the memory identifiers comprising:
- assigning an exclusive memory identifier to a registering component,
- assigning a shared memory identifier to a registered component in response to a request having a unique name and credential requirements, and
- processing a request from a requestor to access the shared memory identifier using name and credentials provided by the requestor;
- and
- enforcing an access control policy with the memory identifiers using an access control enforcer (ACE).
7 more elements
A system comprising:
- a network interface card (NIC) connected to a network to receive and transmit packets, the NIC supporting a full-duplex Gigabit Ethernet interface;
- a processor operating on a platform:
- an input/output controller (IOC) coupled to the processor to establish a connection for packet communication to the network via the NIC;
- a host operating system (OS) running on the platform;
- and
- a protection structure coupled to the host OS comprising:
- a memory identifier storage to store memory identifiers associated with protected components, the memory identifiers including exclusive memory identifiers and shared memory identifiers, the memory identifier storage being protected from access by the host OS, the memory identifier storage comprising:
- a per-page memory identifier table (PMT) to store memory identifiers associated with physical memory pages,
- an exclusive memory identifier book-keeping memory to maintain state information for each of the exclusive memory identifiers, and
- a shared memory identifier book-keeping memory to store access control information and credential requirements for the shared memory identifiers, a memory identifier management service (MMS) coupled to the memory identifier storage to manage the memory identifiers, the MMS residing in a protected environment, the MMS comprising:
- a registration agent to assign an exclusive memory identifier to a registering component and to assign a shared memory identifier to a registered component upon receiving a request having a unique name and credential requirements from the registered component, and
- a shared access processor coupled to the registration agent to process a request from a requestor to access the shared memory identifier using name and credentials provided by the requestor, and
- an access control enforcer (ACE) coupled to the MMS and the memory identifier storage to enforce an access control policy with the memory identifiers.
10 more elements
An article of manufacture comprising:
- a machine-accessible storage medium having data that, when accessed by a machine, cause the machine to perform operations comprising:
- storing memory identifiers associated with protected components a memory identifier storage, the memory identifiers including exclusive memory identifiers and shared memory identifiers, the memory identifier storage being protected from access by a host operating system, wherein the data causing the machine to perform storing the memory identifiers comprise data that, when accessed by the machine, cause the machine to perform operations comprising:
- storing memory identifiers associated with physical memory pages in a per-page memory identifier table (PMT),
- maintaining state information for each of the exclusive memory identifiers in an exclusive memory identifier book-keeping memory,
- storing access control information and credential requirements for the shared memory identifiers in a shared memory identifier book-keeping memory;
- managing the memory identifiers using a memory identifier management service (MMS), the MMS residing in a protected environment, wherein the data causing the machine to perform managing the memory identifiers comprise data that, when accessed by the machine, cause the machine to perform operations comprising:
- assigning an exclusive memory identifier to a registering component,
- assigning a shared memory identifier to a registered component in response to a request having a unique name and credential requirements,
- processing a request from a requestor to access the shared memory identifier using name and credentials provided by the requestor;
- and
- enforcing an access control policy with the memory identifiers using an access control enforcer (ACE).
8 more elements
Dependencies are inferred from the claim text.