Secure multiprotocol interface
View Patent ↗A network interface for secure multiprotocol data communication includes a doorbell circuit, a processor, memory, and a bridge circuit. The doorbell circuit responds to physical I/O addresses of the host that are mapped by a memory management unit by a registration process. An application program seeking to use a multiprotocol channel must register the virtual address of host memory where data for communication is or will be stored and register the virtual address of a page of I/O addresses. Access to the doorbell functions and to the host memory via the memory management unit are therefore denied when the requesting process identifier does not successfully compare with the process identifier for the process that performed the registrations. A password may be stored in the network interface in association with a multiprotocol channel identifier and stored in association with the virtual to physical map used for communication. The network interface may abandon a requested or implied data communication function when passwords do not successfully compare. Methods for multiprotocol communication performed by an application program may include one or more of the steps of (a) establishing a multiprotocol channel where physical I/O addresses of a network controller are secured; (b) registering host memory for use with a multiprotocol channel where physical memory addresses are secured; (c) describing blocks of host memory with reference to a memory handle; and (d) accomplishing data communication of a described block of host memory via an established channel where the data and controls of the channel are secured and the data and controls of other channels are secured. Security is provided against both erroneous operations and operations intentionally effected by rouge processes.
1. A method for data communication, the method performed by a first computer for communication with a second computer, the method comprising:
creating a password;
creating a first map that associates a plurality of virtual I/O addresses with a plurality of physical I/O addresses;
associating the first map with a process, the process identified by a process identifier;
requiring the process identifier for accessing the first map;
creating a second map that associates a plurality of virtual memory addresses with a plurality of physical memory addresses;
determining a memory handle in accordance with a virtual address of the second map;
associating the password and the memory handle with the second map;
requiring the password for accessing the second map;
associating indicia of a protocol with data to be communicated; and communicating according to the protocol data identified in accordance with the memory handle.
2. A system for communicating data between a first computer and a second computer, the system comprising:
means for creating a password;
means for creating a first map that associates a plurality of virtual I/O addresses with a plurality of physical I/O addresses;
means for associating the first map with a process, the process identified by a process identifier;
means for requiring the process identifier for accessing the first map;
means for creating a second map that associates a plurality of virtual memory addresses with a plurality of physical memory addresses;
means for determining a memory handle in accordance with a virtual address of the second map;
means for associating the password and the memory handle with the second map;
means for requiring the password for accessing the second map;
means for associating indicia of a protocol with data to be communicated; and
means for communicating according to the protocol data identified in accordance with the memory handle.
3. A computer readable medium for storing computer executable instructions that when executed, perform a method of communicating data between a first computer and a second computer, the method comprising:
creating a password;
creating a first map that associates a plurality of virtual I/O addresses with a plurality of physical I/O addresses;
associating the first map with a process, the process identified by a process identifier;
requiring the process identifier for accessing the first map;
creating a second map that associates a plurality of virtual memory addresses with a plurality of physical memory addresses;
determining a memory handle in accordance with a virtual address of the second map;
associating the password and the memory handle with the second map;
requiring the password for accessing the second map;
associating indicia of a protocol with data to be communicated; and
communicating according to the protocol data identified in accordance with the memory handle.