US6061794A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for performing secure device communications in a peer-to-peer bus architecture
Assignee: Hewlett Packard Enterprise Development LP
•
Filing: 1997-09-30
•
Granted: 2000-05-09
•
Expires: 2017-09-30
Abstract
Abstract A system and method for performing secure peer-to-peer device communications on an I/O bus, such as a PCI bus, a Fiber Channel bus, an IEEE, 1394 bus or a Universal Serial Bus. The system includes a plurality of intelligent I/O devices, such as intelligent storage devices and/or controllers, communications devices, video devices and audio devices. The I/O devices perform peer-to-peer message and data transfers, thereby bypassing the operating system running on the computer's CPU. The intelligent I/O devices encrypt messages and data before transmitting them on the I/O bus and conversely decrypt the messages and data upon reception. The encryption provides secrecy and/or authentication of the sender. The devices use keys or passwords to encrypt/decrypt the data. The keys are stored in non-volatile memory in the devices and are distributed to the devices by the system BIOS at initialization time. The devices perform access authorization validation using rule sets also distributed by the BIOS at initialization time. The rule sets specify which I/O operations are valid for a peer I/O device to request of a respective I/O device based, preferably, upon the device class/subclasses of the requesting device. In another embodiment, one of the intelligent I/O devices may be a communications device which serves as a firewall for the I/O bus. In this embodiment, the rule set further includes identification information of the remote machines/devices.
Inventors
- 👤 Michael F. Angelo
- 👤 Sompong P. Olarig
- 👤 David R. Wooten
- 👤 Dan J. Driscoll
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 08:37
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/606; G06F21/70; G06F21/82; G06F21/85; G06F2211/00; G06F2211/007; G06F2221/00; G06F2221/21; G06F2221/2141
Claims Analysis
Total Claims: 38
Claim 1
Independent Claim
120 words
A method for protecting a first device coupled to an input/output (I/O) bus from being accessed in an unauthorized manner by a second device coupled to the I/O bus, the method comprising: transmitting to the first device a request to perform a peer-to-peer operation across the I/O bus without intervention from an operating system; determining if said request is authentic as being dispatched from the second device; determining if the second device is authorized to request the first device to perform said peer-to-peer operation; and performing said peer-to-peer operation by said first device, without intervention from the operating system, if said request is authentic from the second device and if the second device is authorized to request said peer-to-peer operation.
Claim 2
Independent Claim
120 words
A method for protecting a first device coupled to an input/output (I/O) bus from being accessed in an unauthorized manner by a second device coupled to the I/O bus, the method comprising: transmitting to the first device a request to perform a peer-to-peer operation across the I/O bus without intervention from an operating system; determining if said request is authentic as being dispatched from the second device; determining if the second device is authorized to request the first device to perform said peer-to-peer operation; and performing said peer-to-peer operation by said first device, without intervention from the operating system, if said request is authentic from the second device and if the second device is authorized to request said peer-to-peer operation.
Claim 3
Dependent Claim
111 words
The method of claim 1, wherein the second device belongs to one of a set of I/O device classes, the method further comprising: receiving a rule set by the first device which identifies a set of peer-to-peer operations which the second device is authorized to request the first device to perform based upon the I/O device class of the second device; and determining if the second device is authorized to request the first device to perform said peer-to-peer operation and determining if the second device is authorized to request said first device to perform said peer-to-peer operation based upon said rule set and said I/O device class of the second device.
Claim 4
Dependent Claim
19 words
The method of claim 2, wherein at least a portion of said rule set is received via user input.
Claim 5
Dependent Claim
21 words
The method of claim 2, wherein at least a portion of said rule set is based upon a predetermined rule set.
Claim 6
Dependent Claim
40 words
The method of claim 1, further comprising: encrypting by the second device said request prior to said second device transmitting to the first device; and decrypting by the first device the encrypted said request prior to performing said peer-to-peer operation.
Claim 7
Dependent Claim
23 words
The method of claim 5, wherein said encrypting is performed using a private key and said decrypting is performed using a public key.
Claim 8
Dependent Claim
60 words
The method of claim 5, wherein said encrypting is authorized based on a digital signature comprising a hash which is encrypted by an originating said second device with a private key of the originating second device and then validated by a receiving said second device by recalculating the hash and then decrypting the transmitted hash and comparing the two values.
Claim 9
Dependent Claim
18 words
The method of claim 7, wherein the two values comprise the recalculated said hash and the decrypted hash.
Claim 10
Dependent Claim
44 words
The method of claim 1, wherein said peer-to-peer operation is a read operation, and wherein said performing said peer-to-peer operation comprises: retrieving by the first device data specified in said peer-to-peer operation; and transmitting said data from the first device to the second device.
Claim 11
Dependent Claim
34 words
The method of claim 9, further comprising: the second device determining if said data is authentic as transmitted by the first device; the second device storing said data only if said data is authentic.
Claim 12
Dependent Claim
35 words
The method of claim 10, further comprising: the first device encrypting the data prior to said transmitting said data to the second device; the second device decrypting said data prior to said storing said data.
Claim 13
Dependent Claim
50 words
The method of claim 1, wherein said peer-to-peer operation is a write operation, wherein data is included in said request, and wherein said performing said peer-to-peer operation comprises: the first device storing said data as specified in said request only if said data is authentically transmitted by the second device.
Claim 14
Dependent Claim
56 words
The method of claim 12, further comprising: the first device encrypting a reply message including a status of the requested peer-to-peer operation and transmitting said reply message to the second device after the storing of said data; the second device receiving said reply message and determining if said reply message is authentic from the first device.
Claim 15
Dependent Claim
21 words
The method of claim 1, wherein said determining if said request is authentic comprises verifying an authenticator appended to said request.
Claim 16
Dependent Claim
12 words
The method of claim 14, wherein said authenticator includes a digital signature.
Claim 17
Dependent Claim
33 words
The method of claim 15, further comprising the second device encrypting said request prior to said second device transmitting on the I/O bus said encrypted request, wherein said encrypted request is said authenticator.
Claim 18
Dependent Claim
12 words
The method of claim 14, wherein said authenticator includes a hash value.
Claim 19
Dependent Claim
89 words
The method of claim 1, further comprising: the second device receiving a packet from a first computer system coupled to the second device, wherein said packet includes said request, wherein the first computer system is dissimilar from a second computer system in which the first and second devices are embodied; the second device forwarding said request to the first device in response to said receiving said packet from the first computer system and prior to said second device transmitting on the I/O bus to the first device said request.
Claim 20
Dependent Claim
43 words
The method of claim 18, further comprising: the second device determining if said packet is authentic from said first computer system; and the second device forwarding said request to the first device only if said packet is authentic from said first computer system.
Claim 21
Dependent Claim
47 words
The method of claim 19, further comprising: the second device determining if the first computer system is authorized to request said peer-to-peer operation; and the second device forwarding said request to the first device only if the first computer system is authorized to request said peer-to-peer operation.
Claim 22
Dependent Claim
109 words
The method of claim 20, wherein said packet includes identification information associated with the first computer system, the method further comprising: the second device receiving a rule set, wherein said rule set identifies a set of peer-to-peer operations which the first computer system is authorized to request the first device to perform based upon the identification information of the first computer system; and wherein said second device determining if the first computer system is authorized to request said peer-to-peer operation comprises the second device determining if the first computer system is authorized to request said peer-to-peer operation based upon said rule set and said first computer system identification information.
Claim 23
Dependent Claim
140 words
A computer system, comprising: an input/output (I/O) bus; first and second devices coupled to the I/O bus, wherein the second device is operable to transmit on the I/O bus to the first device a message including a request to perform a peer-to-peer I/O operation without intervention from an operating system; wherein the first device is operable to receive said message and determine if said message is authentically derived from the second device; wherein the first device is operable to determine if the second device is authorized to request the first device to perform said peer-to-peer I/O operation; and wherein the first device performs said peer-to-peer I/O operation, without intervention from the operating system, only if said peer-to-peer I/O operation request is authentically derived from the second device and if the second device is authorized to request said peer-to-peer I/O operation.
Claim 24
Dependent Claim
140 words
A computer system, comprising: an input/output (I/O) bus; first and second devices coupled to the I/O bus, wherein the second device is operable to transmit on the I/O bus to the first device a message including a request to perform a peer-to-peer I/O operation without intervention from an operating system; wherein the first device is operable to receive said message and determine if said message is authentically derived from the second device; wherein the first device is operable to determine if the second device is authorized to request the first device to perform said peer-to-peer I/O operation; and wherein the first device performs said peer-to-peer I/O operation, without intervention from the operating system, only if said peer-to-peer I/O operation request is authentically derived from the second device and if the second device is authorized to request said peer-to-peer I/O operation.
Claim 25
Dependent Claim
101 words
The computer system of claim 22, wherein the second device belongs to one of a set of I/O device classes, wherein the first device is operable to receive a rule set, wherein said rule set identifies a set of peer-to-peer I/O operations which the second device is authorized to request the first device to perform based upon the I/O device class of the second device, wherein said first device determines if the second device is authorized to request said first device to perform said peer-to-peer I/O operation based upon said rule set and said I/O device class of the second device.
Claim 26
Dependent Claim
53 words
The computer system of claim 22, further comprising: a system BIOS and a processor operable to execute said system BIOS, wherein said system BIOS is operable to provide said rule set to said first device; and wherein the first device comprises a memory for storing said rule set received from said system BIOS.
Claim 27
Dependent Claim
44 words
The system of claim 22, wherein the second device is operable to encrypt said message prior to said second device transmitting to the first device said message and the first device is operable to decrypt said message prior to performing said peer-to-peer I/O operation.
Claim 28
Dependent Claim
33 words
The computer system of claim 25, wherein said second device memory is operable to store a key received from said system BIOS, wherein said second device uses said key to decrypt said message.
Claim 29
Dependent Claim
68 words
The computer system of claim 22, wherein the second device is operable to receive a packet from a remote computer system coupled to the second device, wherein said packet includes said request to perform said peer-to-peer I/O operation, wherein the second device is operable to create said message including said request to perform said peer-to-peer I/O operation in response to receiving said packet from the remote computer system.
Claim 30
Dependent Claim
48 words
The computer system of claim 27, wherein the second device is operable to determine if said packet is authentically derived from the remote computer system, wherein the second device transmits said message to the first device only if said packet is authentically derived from the remote computer system.
Claim 31
Dependent Claim
57 words
The computer system of claim 27, wherein the second device is operable to determine if the remote computer system is authorized to request said peer-to-peer I/O operation and the second device creates said message including said request to perform said peer-to-peer I/O operation only if the remote computer system is authorized to request said peer-to-peer I/O operation.
Claim 32
Dependent Claim
33 words
The computer system of claim 22, wherein said I/O bus is a bus selected from the list comprising: Peripheral Component Interconnect (PCI) bus, Fibre Channel bus, IEEE 1394 bus, Universal Serial Bus (USB).
Claim 33
Dependent Claim
181 words
An I/O device for coupling to an I/O bus, comprising: a processor for performing security services; a memory coupled to the processor for storing a rule set and a key; wherein the I/O device is operable to receive on the I/O bus from a peer I/O device a message including a request to perform a peer-to-peer I/O operation without intervention from an operating system; wherein the I/O device is operable to receive said message and determine if said message is authentically from the peer I/O device using said key stored in said memory; wherein the I/O device is operable to determine if the peer I/O device is authorized to request the I/O device to perform said peer-to-peer I/O operation based upon said rule set stored in said memory; and wherein the first device performs said peer-to-peer I/O operation, without intervention from the operating system, only if said peer-to-peer I/O operation request is authentically from the peer I/O device based upon said key and if the peer I/O device is authorized to request said peer-to-peer I/O operation based upon said rule set.
Claim 34
Dependent Claim
181 words
An I/O device for coupling to an I/O bus, comprising: a processor for performing security services; a memory coupled to the processor for storing a rule set and a key; wherein the I/O device is operable to receive on the I/O bus from a peer I/O device a message including a request to perform a peer-to-peer I/O operation without intervention from an operating system; wherein the I/O device is operable to receive said message and determine if said message is authentically from the peer I/O device using said key stored in said memory; wherein the I/O device is operable to determine if the peer I/O device is authorized to request the I/O device to perform said peer-to-peer I/O operation based upon said rule set stored in said memory; and wherein the first device performs said peer-to-peer I/O operation, without intervention from the operating system, only if said peer-to-peer I/O operation request is authentically from the peer I/O device based upon said key and if the peer I/O device is authorized to request said peer-to-peer I/O operation based upon said rule set.
Claim 35
Dependent Claim
95 words
The I/O device of claim 31, wherein the peer I/O device belongs to one of a set of I/O device classes, wherein said rule set identifies a set of peer-to-peer I/O operations which the peer I/O device is authorized to request the I/O device to perform based upon the I/O device class of the peer I/O device, wherein said I/O device determines if said peer I/O device is authorized to request said I/O device to perform said peer-to-peer I/O operation based upon said rule set and said I/O device class of said peer I/O device.
Claim 36
Dependent Claim
26 words
The I/O device of claim 31, wherein the message is an encrypted message, wherein the I/O device is operable to decrypt said message using said key.
Claim 37
Dependent Claim
173 words
An I/O device for coupling to an I/O bus, comprising: a processor for performing security services; a memory coupled to the processor for storing a rule set and a key; wherein the I/O device is operable to receive from a remote computer a packet including a request for a peer I/O device also coupled to the I/O bus to perform an I/O operation without intervention from an operating system; wherein the I/O device is operable to determine if said packet is authentic from the remote computer using said key stored in said memory; wherein the I/O device is operable to determine if the remote computer is authorized to request the peer I/O device to perform said I/O operation based upon said rule set stored in said memory; and wherein the I/O device forwards said I/O operation request to said peer I/O device only if said packet is authentically from the remote computer based upon said key and if the remote computer is authorized to request said I/O operation based upon said rule set.
Claim 38
Dependent Claim
173 words
An I/O device for coupling to an I/O bus, comprising: a processor for performing security services; a memory coupled to the processor for storing a rule set and a key; wherein the I/O device is operable to receive from a remote computer a packet including a request for a peer I/O device also coupled to the I/O bus to perform an I/O operation without intervention from an operating system; wherein the I/O device is operable to determine if said packet is authentic from the remote computer using said key stored in said memory; wherein the I/O device is operable to determine if the remote computer is authorized to request the peer I/O device to perform said I/O operation based upon said rule set stored in said memory; and wherein the I/O device forwards said I/O operation request to said peer I/O device only if said packet is authentically from the remote computer based upon said key and if the remote computer is authorized to request said I/O operation based upon said rule set.
References Cited (Backward Citations)
US4919545A
Cited
US5390351A
Cited
US5600803A
Cited
US5530701A
Cited
US5551066A
Cited
US5559933A
Cited
US5568552A
Cited
US5745678A
Cited
US5784464A
Cited
US5724027A
Cited
US5787175A
Cited
US5706431A
Cited
US5787427A
Cited
US5805880A
Cited
US5657445A
Cited
US5826014A
Cited
US5841976A
Cited
US5898780A
Cited
US5832228A
Cited
US5692124A
Cited
US5889958A
Cited
US5903721A
Cited
US5859911A
Cited
US5931947A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-05-09 | 2003-11-08 | 2004-05-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-05-09 | 2007-11-08 | 2008-05-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-05-09 | 2011-11-08 | 2012-05-09 | $7700.00 | Window Closed / Lapsed |