Mitigating unauthorized access to data traffic

Patent metadata

Field	Value
Publication number	US-9769123-B2
Application number	US-201313863168-A
Country	US
Kind code	B2
Filing date	Apr 15, 2013
Priority date	Sep 6, 2012
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

One particular example implementation of an apparatus for mitigating unauthorized access to data traffic, comprises: an operating system stack to allocate unprotected kernel transfer buffers; a hypervisor to allocate protected memory data buffers, where data is to be stored in the protected memory data buffers before being copied to the unprotected kernel transfer buffers; and an encoder module to encrypt the data stored in the protected memory data buffers, where the unprotected kernel transfer buffers receive a copy the encrypted data.

First claim

What is claimed is:

1. An apparatus for mitigating unauthorized access to data traffic, the apparatus comprising:
a hardware processor;
memory;
an operating system stack to allocate unprotected kernel transfer buffers in the memory;
a host controller to receive data from peripheral hardware, wherein the data is at least one of video data or audio data, and wherein a policy is constructed to automatically control access to the data based on a location of the apparatus;
a hypervisor to allocate protected memory data buffers and secure memory mapped input/output (MMIO) regions, wherein the hypervisor is booted in a secure manner and the secure boot of the hypervisor is verified, wherein addresses for the protected memory data buffers are to be stored in the secure MMIO regions, wherein the data is to be stored in the protected memory data buffers before being copied to the unprotected kernel transfer buffers and before the data is accessed by operating system drivers for the peripheral hardware, wherein the protected data buffers are only accessible by trusted applications, wherein the hypervisor is located above the host controller in a data processing flow and below a video or audio driver in the data processing flow; and
an encoder module to encrypt the data stored in the protected memory data buffers, wherein the unprotected kernel transfer buffers receive a copy of the encrypted data.

2. The apparatus of claim 1 , wherein the hypervisor is configured to protect the protected memory data buffers using extended page tables so that the protected memory data buffers are not accessible to unauthorized software.

3. The apparatus of claim 2 , the apparatus further comprising:
an input/output memory management unit programmed by the hypervisor to control access to the protected memory data buffers, wherein the protected memory data buffers are not accessible by unauthorized user equipment.

4. The apparatus of claim 3 , wherein the unprotected kernel transfer buffers and the protected memory data buffers are to be allocated when an authorized application that will use the data is initialized.

5. The apparatus of claim 3 , wherein the hypervisor is configured to allocate the secure memory mapped input/output (MMIO) regions, wherein pointers to the protected memory data buffers are to be stored in the secure MMIO regions.

6. The apparatus of claim 5 , wherein only authorized user equipment can access the secure MMIO regions.

7. The apparatus of claim 1 , the apparatus further comprising:
an input/output memory management unit to ensure that the data stored in the protected memory data buffers originated from an authorized source and was not subject to modifications or replay attacks by malware.

8. The apparatus of claim 7 , wherein the input/output memory management unit is configured to validate data integrity by verifying at least one cryptographic hash or at least one signature passed with the data from the authorized source.

9. The apparatus of claim 1 , wherein the unprotected kernel transfer buffers are used to copy the data to an application that requested the data.

10. The apparatus of claim 9 , wherein the application that requested the data is configured to decrypt the data.

11. The apparatus of claim 1 , wherein the protected memory data buffers are to be protected by the hypervisor.

12. The apparatus of claim 1 , further comprising:
memory, wherein the memory includes at least one access control policy that does not allow access to data from the peripheral hardware when the apparatus is in a secure area but does allow access to data from the peripheral hardware when the apparatus is outside of the secure area.

13. At least one non-transitory machine readable storage medium comprising instructions that, when executed, cause an apparatus to:
allocate unprotected kernel transfer buffers in a memory element;
receive data from peripheral hardware at a host controller, wherein the data is at least one of video data or audio data, and wherein a policy is constructed to automatically control access to the data based on a location of the apparatus;
allocate protected memory data buffers and secure memory mapped input/output (MMIO) regions using a hypervisor, wherein the hypervisor is booted in a secure manner and the secure boot of the hypervisor is verified, wherein the data is stored in the protected memory data buffers before being copied to the unprotected kernel transfer buffers and before the data is accessed by operating system drivers for the peripheral hardware, wherein addresses for the protected memory data buffers are to be stored in the secure MMIO regions, wherein the hypervisor is located above the host controller in a data processing flow and below a video or audio driver in the data processing flow;
encrypt the data stored in the protected memory data buffers, wherein the protected data buffers are only accessible by trusted applications; and
copy the encrypted data to the unprotected kernel transfer buffers.

14. The medium of claim 13 , wherein the protected memory data buffers are protected by the hypervisor using extended page tables so that the protected memory data buffers are not accessible by unauthorized software.

15. The medium of claim 14 , further comprising instructions to:
control access to the protected memory data buffers using an input/output memory management unit programmed by the hypervisor, wherein the protected memory data buffers are not accessible by unauthorized user equipment.

16. The medium of claim 13 , wherein, the unprotected kernel transfer buffers and the protected memory data buffers are allocated when an authorized application that will use the data is initialized.

17. The medium of claim 13 , wherein pointers to the protected memory data buffers are stored in the secure MMIO regions.

18. The medium of claim 17 , wherein only authorized user equipment can access the secure MMIO regions.

19. The medium of claim 13 , further comprising instructions to:
ensure that the data stored in the protected memory data buffers originated from an authorized source and was not subject to modifications or replay attacks by malware.

20. The medium of claim 19 , further comprising instructions to:
validate data integrity by verifying at least one cryptographic hash or at least one signature passed with the data from the authorized source.

21. The medium of claim 13 , wherein the unprotected kernel transfer buffers are used to copy the data to an application that requested the data and the application that requested the data decrypts the data.

22. A method for mitigating unauthorized access to data traffic, comprising:
allocating, using a hardware processor, unprotected kernel transfer buffers;
receiving data from peripheral hardware, wherein the data is at least one of video data or audio data, and wherein a policy is constructed to automatically control access to the data based on a location of the apparatus;
allocating protected memory data buffers and secure memory mapped input/output (MMIO) regions using a hypervisor, wherein the hypervisor is booted in a secure manner and the secure boot of the hypervisor is verified, wherein the data is stored in the protected memory data buffers before being copied to the unprotected kernel transfer buffers and before the data is accessed by operating system drivers for the peripheral hardware, wherein the protected data buffers are only accessible by trusted applications, wherein addresses f

Assignees

• Intel Corp

Inventors

• Grewal Karanvir S
• Sahita Ravi L
• Durham David

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/78

  to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) · CPC title