Architecture for virtual security module
AssigneeMicron Technology, Inc.
InventorsDennis M. O'Connor, John P. Brizek
Life of this patent
Estimating the term…
Abstract
A device supports the processing of multiple active applications in a processor through a mapping system that securely identifies and differentiates commands issued by clients. An entity selection signal is generated by the mapping system to signal the processor to process an algorithm and provide services for a specific client using the commands identified for that client and data permitted by a client tracking system for that client. Other data accesses and commands identified for other clients are restricted when processing the algorithm.
Claims13
A processing system comprising:
- a mapping device to receive a first command issued by a first client and a second command issued by a second client, and to generate a dedicated signal, the dedicated signal being separate from the first command and the second command, to uniquely identify the first command issued by the first client from the second command issued by the second client, the mapping device further to identify the first client based upon an Address Space Identifier (ASID);
- and
- a processing device to receive the first command, the second command, and the dedicated signal, the processing device having access to stored data for the first client and the second client where operations requested through the first command identified by the dedicated signal as being from the first client are restricted to data attached with rights previously assigned to the first client and operations requested through the second command identified by the dedicated signal as being from the second client are restricted to data attached with rights previously assigned to the second client.
A method of supporting multiple active applications in a processor, the method comprising:
- identifying first commands issued by a first client from other commands issued by other clients and generating an entity selection signal to identify the first commands issued by the first client, the first client being identified based upon an Address Space Identifier (ASID) and the entity selection signal being separate and distinct from the first commands and the other commands;
- and
- processing an algorithm for the first client using the entity selection signal and the first commands identified for the first client that access data permitted by a client tracking system for the first client while restricting access to data and restricting performing the other commands identified for the other clients when processing the algorithm.
A device, comprising:
- a mapping device to uniquely identify, by an entity selection signal, a first command issued by a client from other commands issued by other clients;
- and
- a tracking system to receive the entity selection signal and link the first command issued from the first client and each of the other commands issued by each of the other clients, respectively, with the entity selection signal, the entity selection signal being configured to restrict performing any commands and restrict access to data in performing operations for applications associated with the client that issued the command, the command being linked to the entity selection signal based upon an Address Space Identifier (ASID).
A non-transitory computer readable storage medium containing instructions, which when executed by one or more processors cause at least one of the one or more processors to perform operations comprising:
- identifying first commands issued by a first client from other commands issued by other clients and generating an entity selection signal to identify the first commands issued by the first client, the first client being identified based upon an Address Space Identifier (ASID) and the entity selection signal being separate and distinct from the first commands and the other commands;
- and
- processing an algorithm for the first client using the entity selection signal and the first commands identified for the first client that access data permitted by a client tracking system for the first client while restricting access to data and restricting performing the other commands identified for the other clients when processing the algorithm.
Dependencies are inferred from the claim text.