Patent ID: 7925801

Claim:
A method for protecting access and operation of input/output (IO) devices, comprising the steps of: issuing from an IO subsystem manager of a computer system a group credential to members of a group of consumers comprising a plurality of consumers that authorizes the consumers to share usage of an IO device, the group credential comprising a first identifier of the group; issuing from an IO resource manager a device credential to members of a group of consumers comprising a second identifier of the group and specifying the IO device and specifying privileges for use of the IO device; conveying a request to use the IO device from one of the consumers to a host gateway in a channel, the request comprising an IO command, the group credential and the device credential; authenticating the one consumer as a member of the group at the host gateway using the group credential; transmitting the request to a device controller of the IO device specified in the device credential; making a determination in the device controller that the request conforms to the privileges of the device credential; and responsively to the determination granting the request.