Direct memory access encryption with application provided keys

Patent metadata

Field	Value
Publication number	US-10310990-B2
Application number	US-201615192493-A
Country	US
Kind code	B2
Filing date	Jun 24, 2016
Priority date	Jun 24, 2016
Publication date	Jun 4, 2019
Grant date	Jun 4, 2019

Abstract

In one example in accordance with the present disclosure, a method may include retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access and determining, at the MMU, a peripheral that is the intended recipient of the encrypted data. The method may also include accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application and decrypting, at the MMU, the encrypted data using the application key and transmitting the decrypted data to the peripheral.

First claim

The invention claimed is:

1. A method for direct memory access encryption with application provided keys comprising:
retrieving, at a memory management unit (MMU), encrypted data from a memory via direct memory access;
determining, at the MMU, a peripheral that is the intended recipient of the encrypted data, wherein the peripheral attached to a computer system;
accessing an application key used for transmission between an application and the peripheral, wherein the application key originates from the application;
decrypting, at the MMU, the encrypted data using the application key;
transmitting the decrypted data to the peripheral;
transmitting, via an operating system of the computer system, an encrypted configuration request including a security key corresponding to the peripheral, a first identity of a hardware management unit and a second identity of the peripheral;
decrypting, at the hardware management unit, the encrypted configuration request;
signing, at the hardware management unit, a response message to the application comprising a matching security key; and
transmitting, via the operating system, the response message to the application.

2. The method of claim 1 , wherein the MMU includes a hardware encryption/decryption unit and the hardware encryption/decryption unit decrypts the encrypted data.

3. The method of claim 1 , wherein a plurality of application keys including the application key is stored in a memory region of the MMU.

4. The method of claim 1 , wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the MMU and a second region of the memory accessed by a processor of the computer system.

5. The method of claim 4 , comprising:
creating, by the operating system, a mapping between an address range of the memory and the peripheral.

6. The method of claim 4 , comprising:
creating, by the hardware management unit, an address range mapping for the application key; and
storing the address range mapping in a key region table in a secure portion of memory.

7. A system for direct memory access encryption with application provided keys comprising:
a non-transitory memory storing instructions;
a processor configured to execute the instructions to cause the system to:
access, at a memory management unit (MMU), data from a peripheral attached to a computer system;
determine, at the MMU, an application that is the intended recipient of the data, wherein the application executes on the computer system;
retrieve an application key used for transmission between the application and the peripheral;
encrypt, at the MMU, the data using the application key; and
transmit the encrypted data to a memory of the computer system; and

a hardware component to:
receive, from an operating system of the computer system, an encrypted configuration request including a security key corresponding to the peripheral, a first identity of the hardware component and a second identity of the peripheral;
decrypt the encrypted configuration request; and
sign a response message to the application comprising a matching security key.

8. The system of claim 7 , wherein the MMU includes a hardware encryption/decryption unit and the encrypted data is encrypted by the hardware encryption/decryption unit.

9. The system of claim 7 , wherein a plurality of application keys including the application key is stored in a memory region of the MMU.

10. The system of claim 7 , wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the MMU and a second region of the memory accessed by a processor of the computer system.

11. The system of claim 7 , wherein the hardware component is further to:
create an address range mapping for the application key; and
store the address range mapping in a key region table.

12. The system of claim 7 , wherein the processor is configured to execute the instructions to cause the system to create, by the operating system, a mapping between an address range of the memory and the peripheral.

13. A system for direct memory access encryption with application provided keys comprising:
a processor to:
encrypt data for a peripheral attached to the system, and
transmit the encrypted data to a memory of the system; and

a first hardware component, operably coupled to the processor, to:
retrieve the encrypted data from the memory via direct memory access,
access an application key used for transmission between an application and the peripheral,
decrypt the encrypted data using the application key, and
transmit the decrypted data to the peripheral; and

a second hardware component coupled to the first hardware component to:
receive an encrypted configuration request including a security key corresponding to the peripheral, a first identity of the second hardware component and a second identity of the peripheral;
decrypt the encrypted configuration request;
sign a response message to the application comprising a matching security key; and
transmit the response message to the application.

14. The system of claim 13 , wherein the first hardware component is further to:
access, via an operating system, a region of the memory accessed by the processor.

15. The system of claim 13 wherein the first hardware component comprises an encryption/decryption hardware unit to decrypt the encrypted data.

16. The system of claim 13 wherein the first hardware component is further to:
access a memory region of the first hardware component storing a plurality of application keys including the application key.

17. The system of claim 13 , wherein the processor is further to:
create a mapping between an address range of the memory and the peripheral.

18. The system of claim 17 , wherein the second hardware component is further to:
create an address range mapping for the application key; and
store the address range mapping in a key region table.

19. The system of claim 17 , wherein the operating system of the computer system provides data mapping between a first region of the memory accessed by the first hardware component and a second region of the memory accessed by a processor of the computer system.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Shaw Adrian
• Ndu Geoffrey
• Dickin Fraser John

Classifications

• G06F12/1408 Primary

  by using cryptography (for digital transmission H04L9/00) · CPC title

• G06F2212/1052

  Security improvement · CPC title

• G06F2212/402

  Encrypted data · CPC title

• G06F12/1466

  Key-lock mechanism · CPC title

• G06F13/28

  using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) · CPC title