Abstract: A memory, system, and method for providing security for data stored within a memory and arranged within a plurality of memory regions. The method includes receiving an address within a selected memory region and using the address to access an encryption indicator. The encryption indicator indicates whether data stored in the selected memory page are encrypted. The method also includes receiving a block of data from the selected memory region and the encryption indicator and decrypting the block of data dependent upon the encryption indicator.

Abstract: A memory management unit (MMU) is disclosed for managing a memory storing data arranged within a plurality of memory pages. The MMU includes a security check unit (SCU) receiving a linear address generated during execution of a current instruction. The linear address has a corresponding physical address residing within a selected memory page. The SCU uses the linear address to access one or more security attribute data structures located in the memory to obtain a security attribute of the selected memory page. The SCU compares a numerical value conveyed by a security attribute of the current instruction to a numerical value conveyed by the security attribute of the selected memory page, and produces an output signal dependent upon a result of the comparison. The MMU accesses the selected memory page dependent upon the output signal.

Abstract: A method and apparatus for restricting the execution of security sensitive instructions. A first security identification (ID) is associated with each of a plurality of instructions or a set of instructions that are to be executed by a processor. Software code running on the processor requests to execute at least one of the plurality of instructions or set of instructions. The processor obtains a second security ID associated with the software code running thereon and compares the second security ID with the first security ID. The processor executes the requested instruction or set of instructions providing that the second security ID matches the first security ID.

Abstract: In a system and method for enabling electronic bill presentment and payment and account and billing distribution, one or more intermediaries are provided to coordinate and control account and billing information transfer among multiple supplying entities and multiple recipient entities including billing portals and consolidators. The distributor provides software to the suppliers and recipients including billing portals that includes a user interface to a billable entity associated with a billing portal. The user interface presents account and billing information to the billable entity and enables payment of bills in response to receiving instructions from the billable entity. Billing information can include the combination of summary billing information and detailed billing contact information. The distributor also provides software to billing entities to expedite the gathering of billing information from the billing entities.

Abstract: A method and an apparatus for performing an I/O device access using targeted security. A software object is executed. A security level for the software object is established. A multi-table input/output (I/O) space access is performed using at least one of the security levels. The function of the object is executed.

Abstract: A method and an apparatus for performing a virtual address based memory access. A software object is executed. A security level for the software object is established. A virtual address based memory access is performed using at least one of the security levels. The function of the object is executed based upon the virtual address based memory access.

Abstract: The present invention provides a method and apparatus for securing portions of a memory. The method includes identifying information for protection and indicating at least one physical address of a memory that houses the information as at least one of read and write disabled. The method includes receiving a request from a program to access the information. The method further includes accessing the information in response to determining that the program has the authority to access the information. The apparatus includes a memory comprising a privileged code. The privileged code is capable of receiving a request to protect selected information and indicating at least one physical address of a memory housing the information as at least one of read and write disabled. The privileged code is capable of receiving a request from a program to access the information.

Abstract: A method and apparatus for controlling access to segments of memory having security data stored therein is provided. A security check unit maintains information for a plurality of segments of memory regarding whether each of these plurality of segments has secure data stored therein. A hint directory maintains information regarding whether any of a plurality of these segments has secure data stored therein. The hint directory is capable of bypassing the security check unit when it receives an address that falls within a plurality of the segments that have been indicated as being free from secure data. When the hint directory determines that a received address falls within one of a plurality of segments that contain secure data, then the address is passed to the security check unit for a closer examination.

Abstract: A method and apparatus for selectively executing an I/O instruction. The method includes creating an I/O permission bitmap in a memory and receiving an I/O port number and a security context identification (SCID) value. The method also includes using the SCID value and the I/O port number to access the I/O permission bitmap stored to obtain a permission bit corresponding to the I/O port and executing the I/O instruction dependent upon a value of the permission bit corresponding to the I/O port. The I/O permission bitmap includes a plurality of permission bits. Each of the permission bits corresponds to a different one of a plurality of I/O ports. Each of the permission bits has a value indicating whether access to the corresponding I/O port is allowed. The I/O port number indicates the I/O port referenced by the I/O instruction. The SCID value indicates a security context level of a memory location including the I/O instruction.

Abstract: A method and system for handling a security exception. The method includes creating a security exception stack frame in secure memory at a base address. The method also includes writing a faulting code sequence address and one or more register values into the security exception stack frame, and executing a plurality of security exception instructions.

Abstract: A host bridge is described including a memory controller and a security check unit. The memory controller is adapted for coupling to a memory storing data arranged within a multiple memory pages. The memory controller receives memory access signals (e.g., during a memory access), and responds to the memory access signals by accessing the memory. The security check unit receives the memory access signals, wherein the memory access signals convey a physical address within a target memory page. The security check unit uses the physical address to access one or more security attribute data structures located in the memory to obtain a security attribute of the target memory page. The security check unit provides the memory access signals to the memory controller dependent upon the security attribute of the target memory page.

Abstract: A system apparatus and method for providing access security for a subject device. The apparatus includes a security check unit (SCU) configured to be coupled to a transmission medium. The SCU is configured to monitor signals on the transmission medium and to detect an attempt by a first device coupled to the transmission medium to access a second device coupled to the transmission medium based upon the signals. The SCU is also configured to determine an identity of the first device based upon the signals and to control access to the second device by the first device dependent upon the identity of the first device. The method includes monitoring signals and detecting an attempt by an additional device to access the subject device based upon the signals. The method also includes using the signals to determine an identity of the additional device and controlling access to the subject device dependent upon the identity of the additional device.

Abstract: A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to communicate data over a communications channel in accordance with assigned transmission parameters. The physical layer hardware unit is adapted to receive an incoming signal over the communications channel and sample the incoming signal to generate a digital received signal. The processing unit is adapted to execute a software driver including program instructions adapted to extract control codes from the digital received signal, generate an authentication code, and transfer the control codes and the authentication code to the physical layer hardware unit. The physical layer hardware unit is adapted to signal a security violation in response to the control codes being inconsistent with the authentication code.

Abstract: A method and apparatus for preventing radio communication system access by an unauthorized modem. The apparatus comprises a signal detector that determines if an authorization signal has been received from the base station within a specified period of time. The authorization signal authorizes the apparatus to communicate with the base station. A transmitter transmits information to the base station, and a controller disables the transmitter of the apparatus providing that the authorization signal has not been received within the specified period of time.

Abstract: A computer system includes a peripheral device and a processing unit. The processing unit is adapted to execute a driver for interfacing with the peripheral device in a standard mode of operation and an authentication agent in a privileged mode of operation, wherein the authentication agent includes program instructions adapted to authenticate the driver. The peripheral device may comprise a communications device, such as a software modem. A method for identifying security violations in a computer system includes executing a driver in a standard processing mode of a processing unit; transitioning the processing unit into a privileged processing mode; and authenticating the driver in the privileged processing mode. The driver may be adapted for interfacing with a communications peripheral device, such as a software modem.

Abstract: A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to communicate data over a communications channel. The physical layer hardware unit is adapted to receive unencrypted control codes and encrypted user data over the communications channel and transmit an upstream data signal over the communications channel based on the control codes. The processing unit is adapted to execute a software driver for interfacing with the physical layer hardware unit. The software driver includes program instructions for implementing a protocol layer to decrypt the user data and provide the upstream data to the physical layer hardware unit. A method for configuring a transceiver includes receiving unencrypted control codes over a communications channel; receiving encrypted user data over the communications channel; and transmitting an upstream signal over the communications channel based on transmission assignments defined by the control codes.

Abstract: A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to communicate data over a communications channel in accordance with assigned transmission parameters and receive an incoming signal over the communications channel and sample the incoming signal to generate a digital received signal. The processing unit is adapted to execute a standard mode driver in a standard mode of operation and a privileged mode driver in a privileged mode of operation. The standard mode driver includes program instructions adapted to extract encrypted data from the digital received signal and pass the encrypted data to the privileged mode driver. The privileged mode driver includes program instructions adapted to decrypt the encrypted data to generate decrypted data including control codes and transfer the control codes to the physical layer hardware unit.

Abstract: A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to receive user data over a first communications channel and control codes over a second communications channel. The physical layer hardware unit is further adapted to transmit an upstream data signal over the first communications channel based on transmission assignments defined by the control codes. The processing unit is adapted to execute a software driver for interfacing with the physical layer hardware unit. The software driver includes program instructions for implementing a protocol layer to decrypt the user data and provide upstream data to the physical layer hardware unit for generation of the upstream data signal.

Abstract: A communications system includes a physical layer hardware unit and a processing unit. The physical layer hardware unit is adapted to communicate data over a communications channel in accordance with assigned transmission parameters. The physical layer hardware unit is adapted to receive an incoming signal over the communications channel and sample the incoming signal to generate a digital received signal. The processing unit is adapted to execute a standard mode driver in a standard mode of operation and a privileged mode driver in a privileged mode of operation. The standard mode driver includes program instructions adapted to extract control codes from the digital received signal and configure the physical layer hardware assigned transmission parameters based on the control codes.

Abstract: In one aspect of the present invention, an apparatus for converting a virtual address to a physical address is provided. The apparatus comprises a comparator, a first mechanism, and a second mechanism. The comparator is adapted to receive the virtual address and deliver a first signal indicating that the virtual address is outside a first preselected range, and a second signal indicating that the virtual address is within the first preselected range. The first mechanism is adapted to generate a first physical address from the virtual address in response to receiving the first signal, and the second mechanism is adapted to generate a second physical address from the virtual address in response to receiving the second signal.