Secure direct memory access
AssigneeIntel Corporation
InventorsJayant Mangalampalli, Venkat R. Gokulrangan
Life of this patent
Estimating the term…
Abstract
Examples are disclosed for establishing a secure destination address range responsive to initiation of a direct memory access (DMA) operation. The examples also include allowing decrypted content obtained as encrypted content from a source memory to be placed at a destination memory based on whether destination memory addresses for the destination memory fall within the secure destination address range.
Claims28
A method implemented at host computing device comprising:
- establishing a secure destination address range responsive to initiation of a direct memory access (DMA) operation to be performed by a DMA module that includes obtaining encrypted content from a source memory, decrypting the encrypted content, and placing the decrypted content at a secure destination memory;
- receiving, at a controller of the DMA module, one or more destination addresses associated with the secure destination memory from an operating system executed by a host central processing unit (CPU) through a portion of memory shared between the controller and the operating system;
- validating, at the controller, whether the one or more destination addresses falls within the secure destination address range;
- and
- allowing, at the controller, the DMA module to place the decrypted content at the secure destination memory based on the one or more destination addresses falling within the secure destination address range.
An apparatus comprising:
- a processor circuit;
- a direct memory access (DMA) module communicatively coupled to the processor circuit;
- and
- a memory unit communicatively coupled to the processor circuit, the memory unit arranged to store a destination manager operative on the processor circuit to establish a secure destination address range responsive to initiation of a DMA operation to be performed by the DMA module to move encrypted content from a source memory, decrypt the encrypted content, and place the decrypted content at a secure destination memory, the destination manager also operative to receive one or more destination addresses associated with the secure destination memory from an operating system executed by a host central processing unit (CPU) through a portion of memory shared between the destination manager and the operating system, the destination manager further operative to validate whether the one or more destination addresses falls within the secure destination address range and to allow the DMA module to place the decrypted content at the secure destination memory based on the one or more destination addresses falling within the secure destination address range.
An article of manufacture comprising a non-transitory storage medium containing instructions that when executed cause a direct memory access (DMA) system for a host computing device to:
- establish a secure destination address range responsive to initiation of a DMA operation to be performed by a DMA module of the DMA system that includes obtaining encrypted content from a source memory, decrypting the encrypted content, and placing the decrypted content at a secure destination memory;
- receive, at the DMA system, one or more destination addresses associated with the secure destination memory from an operating system executed by a host central processing unit (CPU) through a portion of memory shared between the destination manager and the operating system;
- validate, at the DMA system, whether the one or more destination addresses falls within the secure destination address range;
- and
- cause the DMA module to place the decrypted content at the secure destination memory based on the one or more destination addresses falling within the secure destination address range.
Dependencies are inferred from the claim text.