International Business Machines Corporation

Michael Backes

Jan Leonard Camenisch

Leah Shalev

Shmuel Ben-Yehuda

Julian Satran

Zorik Machulsky

Ilan Shimony

Michael Waidner

Thomas Basil Smith, Iii

Ton Engbersen

Guenter Karjoth

Thomas R Gross

Luke James O'Connor

A computer-implemented system and method for protecting a memory are provided. The system includes a memory section with privileged and non-privileged sections, a host gateway (HG) to generate a capability credential, a device controller (DC) to append the credential to data transmitted to the memory, and at least one IO device enabled to do direct memory access (DMA) transactions with the memory.

Memory protection and security using credentials

Method and system for memory protection and security using credentials

The present invention relates to a tag identification system comprising: a plurality of tags, each tag being identifiable by an associated tag identifier, and at least one tag comprising at least one link to at least one other tag in said group.

Tag identification system

For detecting a blocker RFID tag, the following steps are conducted. First, a random identifier of a given bit length is created. Alternatively, an identifier is selected out of a probing set, which is stored on a data storage device. The probing set comprises of identifiers, which are not being used as identifiers for a given set of RFID tags. In a second step, a response from all RFID tags is requested having an identifier matching the random identifier or, respectively, the selected identifier. In a third step, it is determined, depending on receiving or not receiving a response, whether the blocker RFID tag is present.

Detecting a blocker RFID tag

A computer-implemented method for protecting a memory is provided. The method includes responsive to a direct memory access (DMA) request received from a consumer for a transaction of data from an IO device to the memory, the request including an IO command and a capability (CAP), generating a cryptographically signed capability (CAPB), forming a credential from CAP and CAPB, appending the credential to the IO command, configuring the IO device according to the credential and the IO command, transmitting the data from the IO device to the memory and prior to allowing execution of the DMA, authenticating that the credential is valid, further includes regenerating CAPB from a key available to an authenticating entity and from the CAP (included in CAPB) and verifying that the memory region information described in the cryptographically signed capability is the same as the requested region that was originally created, and that the cryptographically signed capability encompasses the IO command.

Growing community of inventors

Thalwil, Switzerland

Michael Backes