P2P Control Logic Lookup Table for I/O Partition Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing systems lack a mechanism to control peer-to-peer (P2P) operations effectively, leading to unauthorized access between logically partitioned partitions, which compromises the reliability, availability, and serviceability of the system.
Innovation Solution
Implementing a P2P control logic that utilizes a lookup table to determine if the requester ID of an I/O operation matches an entry, allowing or rejecting the operation based on an accept/reject bit, thereby controlling P2P operations and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If P2P operations are allowed in a logically partitioned data processing system, then service quality and operational flexibility are improved, but system reliability and security deteriorate due to unauthorized access between partitions
Solution Approach 1:
The patent segments the P2P operation control by introducing partition identifiers into the lookup table entries. Each entry is divided into distinct fields: requester ID, target ID, and accept/reject bit. This segmentation allows the system to evaluate access requests from different partitions independently, enabling flexible P2P operations within partitions while blocking unauthorized cross-partition access, thus resolving the contradiction between operational flexibility and system reliability
Solution Approach 2:
The patent introduces a firmware intermediary (the lookup table mechanism) that mediates between P2P operation requests and the actual I/O devices. The firmware layer intercepts P2P requests, consults the lookup table to determine authorization based on partition identifiers, and either permits or blocks the operation. This intermediary mechanism enables the system to maintain reliability by filtering unauthorized access while preserving flexibility for authorized operations, resolving the contradiction between these two requirements
2Reliability
If a bit in a bridge is used to turn off P2P access entirely, then system security is improved by preventing malicious access, but operational flexibility deteriorates as P2P access is blocked even when desired
Solution Approach 1:
The patent replaces the static, all-or-nothing P2P control mechanism with a dynamic, selective control system. Instead of a single bit that uniformly enables or disables all P2P operations, the system uses a lookup table with individual accept/reject bits for each requester-target pair. This dynamic approach allows the system to adaptively permit or block P2P operations on a case-by-case basis, maintaining security while preserving necessary operational flexibility
Solution Approach 2:
The patent applies local quality control by allowing different authorization settings for different P2P operation pairs. Each lookup table entry can have its own accept/reject bit configuration, enabling the system to apply security policies locally rather than globally. This means that P2P access can be permitted for specific authorized pairs while blocked for others, achieving both security and operational flexibility simultaneously
Data Source
AI summary
A method and an apparatus are provided for restricting input/output device peer-to-peer operations in a data processing system to improve reliability, availability, and serviceability. A peer-to-peer (P2P) control logic is provided to perform a lookup of P2P lookup table entries. Each P2P lookup table entry comprises bus, device and function number fields, optional control fields, and an accept/reject bit. Upon receiving a communication request from a requesting I/O device, P2P control logic implemented in either a logical bridge or an I/O device identifies the requester ID of the request and determines if a match exists in the P2P lookup table entries. If a match is found and the accept/reject bit is enabled, I/O operations can be received from the requester.