Patent ID: 8161287
Filing Date: 2012-04-17
Classification: G06F

Abstract:
1. A computer-implemented method for secure memory access management, said method comprising: receiving a request for data transaction for an operating system to access an IO device via a direct memory access (DMA) procedure, wherein the request comprises an IO command and a capability field (CAP), wherein the CAP comprises at least one of a target memory address and an IO command indicating whether target data is to be read from or written to the target memory address; cryptographically signing the CAP using a local key to generate a credential; submitting the request with the generated credential to a device controller (DC) associated with the IO device configured to support the DMA procedure, resulting in the IO device servicing the submitted request, wherein the target data is provided to the DC; receiving from the DC the target data with the credential appended to the target data; authenticating the credential appended to the target data to verify the target data, wherein the authenticating is performed by using the local key used to cryptographically sign the CAP used to generate the credential; wherein at creation time of said CAP, a time stamp (TS) of a time window (TW) associated with the time of creation of said CAP is cryptographically signed and the cryptographically signed TS is attached to the CAP used to generate the credential, such that the TS is passed to the DC as a part of the request that is submitted to the DC; and revoking said credential when said TS is beyond a certain threshold, in response to receiving from the DC the target data with the credential that includes the TS as a part of the CAP.