SECURE DIRECT MEMORY ACCESS

• US 20110078760A1
• Filed: 05/08/2009
• Published: 03/31/2011
• Est. Priority Date: 05/13/2008
• Status: Abandoned Application

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: De Perthuis, Hugues J.M.
• Application Number:
  US12/992,089
• Publication Number:
  US 20110078760A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A data processing system comprises a memory, a memory protection unit, and one or more IP units connected to the memory via the memory protection unit. The memory protection unit is arranged to logically partition the memory into different regions, to maintain a policy for each region, the policy defining access rights to the respective region and defining the safety status of data written in the respective region, to check access requests writing data from a first region to a second region, and to refuse the access request if the safety status, according to the respective policy, of the written data in the second region is not maintained.

Claims

1. A data processing system comprising:

a memory;

a memory protection unit; and

at least one IP unit connected to the memory via the memory protection unit,

wherein the memory protection unit is arranged to logically partition the memory into different regions,

to maintain a policy for each region, the policy defining access rights to the respective regions and defining the safety status of data written in the respective regions,

to check access requests writing data from a first region to a second region, and

to refuse the access request if the safety status, according to the respective policy, of the written data in the second region is not maintained.

2. A system according to claim 1, wherein the memory protection unit is further arranged to access a streaming graph of an application, and to compare access requests against the streaming graph.

3. A system according to claim 2, further comprising a central processing unit connected to the memory via the memory protection unit, wherein memory protection unit is further arranged to check any allocation of memory to an IP unit, by the central processing unit, against the streaming graph.

4. A system according to claim 1, wherein the memory protection unit is arranged to maintain a policy for a region that comprises different access rights for different IP units.

5. A system according to claim 4, wherein the maintained policy for an

6. A method of operating a data processing system having a memory, a memory protection unit, and at least one IP unit connected to the memory via the memory protection unit, the method comprising:

logically partitioning the memory into different regions,

maintaining a policy for each region, the policy defining access rights to the respective regions and defining the safety status of data written in the respective regions,

checking access requests writing data from a first region to a second region, and

refusing the access request if the safety status, according to the respective policy, of the written data in the second region is not maintained.

7. A method according to claim 6, further comprising accessing a streaming graph of an application, and comparing access requests against the streaming graph.

8. A method according to claim 7, wherein the system further comprises a central processing unit connected to the memory via the memory protection unit, and the method further comprises checking any allocation of memory to an IP unit, by the central processing unit, against the streaming graph.

9. A method according to claim 6, wherein the step of maintaining a policy for each region comprises maintaining a policy for a region that comprises different access rights for different IP units.

10. A method according to claim 9, wherein the maintained policy for an IP unit for a region is one of no access, read only, read and write, or execute.