DE102013113402B4 - Controller unit and method for feedback-free access and / or data flow control between a memory unit and a processing unit - Google Patents

Abstract

zu multiplizieren, und
wobei xci ein Bildregisterwert ist und nur in der jeweiligen Zielspeicherklasse (21) entsprechend der jeweiligen Primzahl (Ai) abgelegt wird und Bi eine ganze Zahl größer oder gleich Null ist, wobei beim Auslesen eines Bildregisterwerts (xci) aus den Zielspeicherklassen (21) dieser Bildregisterwert durch die jedem Bildregisterwert eindeutig zugeordnete Primzahl (Ai) geteilt wird, wobei der entstandene Registerwert nur in seine ihm zugeordnete Registerzelle eingelesen wird, so dass das Zugriffsprüfmodul (4) erkennt, wenn der Registerwert, eindeutig zugeordnet einer Registerzelle,
in eine andere Registerzelle, eindeutig einem anderen Registerwert zugeordnet, abgelegt wird und/oder das Zugriffsprüfmodul (4) ein Ablegen dieses Registerwerts in der anderen Registerzelle verhindert.

Controller unit (1) for non-reactive access and / or data flow control between at least one memory unit (2) and at least one processing unit (3) (CPU), comprising at least one memory unit (2) and at least one processing unit (3), wherein
the memory unit (2) comprises at least two target memory classes (21) in which at least one execution function (FKT) is stored and / or executable and each execution function (FKT) is uniquely assigned such that each execution function (FKT) of at least one target memory class (21) is assigned, for access and / or data flow control in a data transfer channel at least one access checking module (4) between the memory unit (2) and the processing unit (3) is interposed,
characterized in that
each target storage class (21) is uniquely associated with exactly one positive prime number (Ai; i> = 0), the access checking module (4) being arranged and arranged to store register values (xi; i> = 0) of register cells (R) of the processing unit (3) (CPU) with the target memory class (21) a uniquely assigned prime number (Ai) according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

to multiply, and
wherein xci is an image register value and is stored only in the respective target storage class (21) corresponding to the respective prime number (Ai) and Bi is an integer greater than or equal to zero, wherein upon reading an image register value (xci) from the Target memory classes (21) this image register value by the image register unique value uniquely assigned prime (Ai) is divided, the resulting register value is read only in its associated register cell, so that the access check module (4) detects when the register value, uniquely assigned to a register cell,
is stored in another register cell, uniquely assigned to another register value, and / or prevents the access checking module (4) from storing this register value in the other register cell.

Description

The present invention relates to a controller unit for non-reactive access and / or data flow control between at least one memory unit and at least one processing unit and a method for non-reactive access and / or data flow control between at least one memory unit and at least one processing unit according to the respective preambles of claims 1 and 8 ,

The memory unit comprises at least two target memory classes, in each of which at least one execution function is stored and / or executable and each execution function is uniquely assigned to at least one target memory class, each target memory class being uniquely associated with exactly one positive prime number.

Such prime-coded controller units are already well known in the art. In particular, the state of the art knows such controller units in which a memory unit as a whole is addressed by means of a prime number assigned to this memory unit. If, for example, a register value is generated in a register cell uniquely assigned to the register value in the processing unit (CPU), this register value can be stored in the memory unit by prime number multiplication.

Out Mottok, J .; Schiller, F; Zeitler, T .: Embedded Systems - Theory and Design Methodology. Intech, March 2012, p.31 - 50 For example, non-reactive access and / or data flow control between a memory and a processing unit is known, with mapping of values by primes and a mapping rule, wherein a check of the correctness of the mapped values is performed before output.

However, hitherto only such memory units could be represented in the prior art in which a single prime number was assigned to only one target memory class. In other words, only one memory protection for the entire memory unit could be realized by means of this one prime, with memory protection for individual target memory classes of the memory unit (each having different security classes) not previously proposed by the prior art by means of prime coding.

Alternative memory protection mechanisms, however, which propose a use of a prime number deviating memory protection instead are also known from the prior art.

Generally, a memory protection should fulfill the "ISO26262". The "ISO26262" replaces the "IEC61508" for the automotive industry as the standard for the functional safety of road vehicles. In particular, "ISO26262" ("functional safety-road vehicles") is a standard for the functional safety of road vehicles.

• - Der für die Automobilbranche typische Lebenszyklus, insbesondere die durchgängige Verifikation beziehungsweise Validation,
• - die Schnittstellen beziehungsweise die Zuweisung der Sicherheitsverantwortung bei verteilter Entwicklung teilweise über mehrere Zulieferebenen hinweg,
• - der Einsatz konfigurierbarer Software, deren Verhalten möglicherweise erst nach Serienstart durch Kalibrierdaten bestimmt wird.

The "ISO26262" described here provides the automotive industry with an applicable standard for functional safety, which, in contrast to the "IEC61508", was developed with the involvement of the automotive industry and thus takes into account their specific concerns. These are for example:

• - The life cycle typical of the automotive industry, in particular the continuous verification or validation,
• - the interfaces or the assignment of the responsibility for security in distributed development partly across multiple levels of suppliers,
• - The use of configurable software whose behavior may only be determined by calibration data after the start of series production.

However, the abovementioned ISO26262 places high demands on freedom from feedback as well as on the corresponding memory protection in the integration of different security classes on an execution and / or storage unit.

From the prior art, various measures are known functions of different security classes (eg, safety-related and non-safety-relevant functions) with the help of software / hardware mechanisms safely and without repercussion to separate (to English: software partitioning).

In particular, the following three memory protection mechanisms are described in order to comply with the ISO26262 standard:

First, the so-called "value / complement storage", also block replication according to ISO26262, should be mentioned. Basically, the "value / complement storage" is based on the principle that in addition to storing a date in the memory unit, an associated "number" complement is calculated and stored in a separate memory unit. During subsequent access, value and complement (content of the memory cell or address value of the memory cell) and a corresponding complement thereto are checked for consistency, for example by means of a test module.

In the sense of access protection, only a distinction is made between variables without complement (QM) and variables with complement possible (ASIL). Within the target storage classes, however, as already stated several times, no distinction is possible.

Another memory protection mechanism can be seen in the "Memory Protection Unit". Controller units known from the prior art and their architectures offer hardware mechanisms which restrict access to specific memory areas and address areas can also be assigned to specific memory classes, but such applications of the "Memory Protection Unit" described here are generally limited by this Only a few storage classes are available and thus only a very rough classification is possible or a complicated reconfiguration is necessary. Due to the fact that the effort in such a "Memory Protection Unit" is generally very high, the controller unit requires high performance parts in the "high-performance range" and, moreover, has to start a periodically cyclical, for example, periodic checking mechanism.

All in all, the application of the well-known from the prior art "Memory Protection Unit" is not only expensive, but also very expensive.

As a further storage protection standard for the fulfillment of the ISO26262 the "checksum calculation" should be mentioned. In this case, a checksum is calculated via defined memory areas with a generator polynomial assigned to the memory area. This checksum is stored in memory at a specific location. If a date is now accessed in this storage class, the entire area must be read out and the checksum calculated. If this does not match the filed, either an access into an incorrect class (wrong generator polynomial) or the memory was corrupted. For write access, the stored checksum must be adapted accordingly. This method is therefore hardly used in practice and, like the method according to the "Memory Protection Unit" described here, is likewise very expensive.

It is therefore an object of the present invention to provide a controller unit and a method by means of which it is possible to obviate the disadvantages of the prior art.

The object is achieved by a controller unit for non-reactive access and / or data flow control between a memory unit and a processing unit according to claim 1 and by a method for non-reactive access and / or data flow control between a memory unit and a processing unit according to claim 8.

zu multiplizieren, wobei xci ein Bildregisterwert, eines Registerwerts xi ist und nur in der jeweiligen Zielspeicherklasse entsprechend der jeweiligen Primzahl Ai abgelegt wird und Bi eine ganze Zahl größer oder gleich Null ist. „i“ ist dabei jeweils ein ganzzahliger, positiver Laufindex.In order to provide a controller unit, which makes it possible in a particularly simple, cost-effective and time-saving manner to eliminate the above-mentioned problems and therefore to offer a controller unit which can occupy different memory classes (different security levels) of the memory unit with memory protection without interference Among other things, the present invention makes use of the idea that at least one access checking module is interposed between the memory unit and the processing unit for access and / or data flow control in a data transfer channel, wherein the access checking module is set up and provided for register values of register cells of the processing unit (CPU ) with a prime number uniquely assigned to a target storage class according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

where xci is an image register value, a register value xi and is stored only in the respective target memory class corresponding to the respective prime number Ai and Bi is an integer greater than or equal to zero. "I" is an integer, positive run index.

In other words, by means of the access checking module described here and the associated multiplication of the register values with a primes uniquely assigned to the respective register values, a mechanism is provided which makes it possible, in a particularly simple and cost-effective manner, to prevent register values of the register cells in target memory classes, which are not intended for the respective register values are stored incorrectly. Namely, by means of the multiplication by the respective primes via the generation of the image register value, an assignment of this image register value to corresponding target memory classes comprising the respective execution functions uniquely assigned to these target memory classes is possible.

zu multiplizieren, und wobei xci ein Bildregisterwert ist und nur in der jeweiligen Zielspeicherklasse entsprechend der jeweiligen Primzahl abgelegt wird und Bi eine ganze Zahl größer oder gleich Null ist.According to at least one embodiment, the controller unit for feedback-free access and / or data flow control between at least one memory unit and at least one processing unit at least one memory unit and at least one processing unit, wherein the memory unit comprises at least two target memory classes, in each of which at least one execution function stored and / or executable and each execution function is uniquely assigned in that each embodiment is assigned to at least one target storage class, where each target storage class is uniquely associated with exactly one positive prime number. In this case, at least one access checking module is connected between the memory unit and the processing unit for pass-through and / or data flow control in a data transfer channel, which is set up and provided for register values (xi; i> = 0) of register cells of the processing unit (CPU) with one of the Target storage class a uniquely assigned prime number (Ai; I> = 0) according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

where xci is an image register value and is stored only in the respective target storage class corresponding to the respective prime number and Bi is an integer greater than or equal to zero.

In accordance with the invention, when an image register value uniquely assigned to one prime number and one destination storage class is stored in another destination storage class uniquely assigned to another prime number, and / or the access checking module prevents that image register value from being stored in that other destination storage class.

In this respect, it is ensured by means of an access checking module configured in a particularly simple manner without the use of an additional hardware component that only those register values are stored in the respective target memory classes, which are also unambiguously assigned to a corresponding prime number for this target memory class.

In other words, it is prevented that a register value is stored erroneously either by multiplication by an incorrect prime number or by another deposition process in a target storage class that does not correspond to this register value and in particular to this image register value. In this respect, it is therefore particularly easy to prevent unauthorized access to a target memory class, if an attempt is made to influence and / or prove the remaining remaining target memory classes with, for example, an already known image register value. Access to target memory classes which does not take place by means of the image register value provided for this purpose (including the prime number provided for this purpose) is therefore prevented. It can thus be a particularly simple and detailed subdivision of the memory unit and in particular the target memory classes, in different security classes, realized.

According to the invention, if a register value, uniquely assigned to a register cell, is stored in another register cell, uniquely assigned to another register value, and / or the access checking module prevents this register value from being stored in the other register cell. In other words, a "bidirectional" memory protection mechanism is thus implemented. Namely, not only can image register values be accommodated in uniquely designated target memory classes associated therewith by means of the access checking module described herein, but also, instead or additionally, register values may be accommodated in only dedicated register cells of the processing unit (CPU). Such a bidirectionality therefore ensures a particularly high degree of protection against erroneous inputs and assignments of different values in different target memory classes / register cells in each data transfer direction, so that a correspondingly high access and memory protection is realized in each data transfer direction via the access checking module described here.

In accordance with at least one embodiment, the access checking module outputs at least one error message when a faulty assignment is detected. Such an error message can not only include an optical visual message to a supervisor or operator, a faulty assignment can also mean switching off end components (also actuators). For example, if an unauthorized user attempts to gain access to an image register value stored in one of the destination memory classes, by means of a prime number not assigned to that image register value, such a memory class may be disconnected from communication with the processing unit (CPU) or at least monitored by the access check module.

In accordance with at least one embodiment, when an image register value is read from the target memory classes, these image register values are divided by the prime number uniquely assigned to each image register value, the resulting register value only being read into its associated register cell. It is conceivable that then Bi = 0 is set. In this respect, such a conversion of the image register values into register values is an encoding rule inverted to the above multiplication by a prime number.

In accordance with at least one embodiment, the access checking module comprises at least one multiplier module for multiplying the respective prime number by a register value assigned to this prime number and adding the integer Bi and / or at least one division module to divide the respective image register value. In this respect, the access checking module in each case within this access checking module comprises modules arranged separately from one another in the form of the multiplier module and the dividing module, each of which is separate from one another Perform arithmetic operations (multiplication and division). However, it is also conceivable that the multiplier module with the division module is in a data transfer. For example, different multiplier properties (eg, in terms of time) are dependent on the division properties of the division module. In such an embodiment, therefore, the multiplier module and the division module are not independently operated or operable. However, it is alternatively possible for the multiplier module to be operated or operable completely independently of the computing operations of the division module. This can preferably be set on the access check module.

In accordance with at least one embodiment, the access checking module is configured to permit an access of an execution function, which is stored in a destination storage class, to be predefined to at least one other destination storage class. It is therefore conceivable that a given execution function can also be deposited and / or have access to a target storage class that can actually be used for another execution function. This particularly advantageously not only enables communication between the memory unit and the processing unit, but additionally via the above-mentioned memory protection generated by the introduction of the primes, also an exchange of information of the individual target memory classes by means of one and the same function with each other. It is namely conceivable that individual contents of the target storage classes can be transferred by means of the execution function from one target storage class to another target storage class.

In accordance with at least one embodiment, an execution function of a target storage class has access to a predefinable selection from all or a spectrum of the existing target storage classes. In this context, the term "spectrum" is a selection from existing target storage classes. For example, the spectrum can only consist of one target storage class or of at least two target storage classes.

According to at least one embodiment, one and the same execution function is identically deposited in at least two target storage classes and / or at least two target storage classes can be accessed by one and the same execution function. In this respect, the "multiple" deposit of execution functions in the respective target storage classes and / or the permission of the execution function for access of several target storage classes allow a particularly large variability in the setting of an access memory management and its access security.

In the following, a method for non-reactive access and / or data flow control will be described. For example, the method described here can be carried out with a controller unit according to at least one of the previous embodiments. Ie. All features of the controller unit described herein are also disclosed for the method described herein, and vice versa.

According to at least one embodiment, the method described here for non-reactive access and / or data flow control between at least one memory unit and at least one processing unit (CPU) comprises at least one memory unit and at least one processing unit, wherein the memory unit comprises at least two target memory classes, in each of which at least one execution function is stored and / or executable, and each execution function is uniquely associated with each embodiment being associated with at least one destination storage class, each destination storage class being uniquely, preferably one-to-one, associated with exactly one positive prime.

zu multiplizieren, und wobei xci ein Bildregisterwert ist und nur in der jeweiligen Zielspeicherklasse entsprechend der jeweiligen Primzahl abgelegt wird und Bi eine ganze Zahl größer oder gleich Null ist.In this case, at least one access checking module is connected between the memory unit and the processing unit for pass-through and / or data flow control in a data transfer channel, which is set up and provided for register values (xi; i> = 0) of register cells of the processing unit (CPU) with one of the Target storage class a uniquely assigned prime number (Ai; I> = 0) according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

where xci is an image register value and is stored only in the respective target storage class corresponding to the respective prime number and Bi is an integer greater than or equal to zero.

In this respect, the method described here has the same advantages and refinements as in connection with the controller unit described above.

In the following, the controller unit described here and the method described here will be described in detail with reference to an embodiment and the associated figure.

In the 1A is a schematic representation of a controller unit described here according to an embodiment set forth.

In the 1B schematically a transmission of a register value (to English: original domain) by means of a coding rule (or mapping rule) is shown.

In the exemplary embodiment and the figures, identical or equivalent components are each provided with the same reference numerals. The elements shown here are not to be considered as scalable. Rather, individual elements may be exaggerated for better understanding.

In the 1A schematically is an embodiment of a controller unit described here 1 for feedback-free access and / or data flow control between at least one memory unit 2 and at least one processing unit 3 (CPU). In particular, it can be seen that the memory unit 2 a variety of target storage classes 21 in which in each case an execution function ( FCT ) and is executable and any execution function ( FCT ) clearly a target storage class 21 assigned. Every target storage class is here 21 again unambiguously, preferably a unique associate with exactly one positive prime number Ai.

zu multiplizieren. Dabei gilt stets für alle Variablen, dass i größer gleich Null und eine ganze Zahl ist. Insbesondere kann ein, mittels der hier beschriebenen Codierungsvorschrift, Bildregisterwert xci ermittelt werden, welcher nur in einer diesem Bildregisterwert xci eindeutig zugeordneten Zielspeicherklasse 21 entsprechend der jeweiligen Primzahl Ai ablegt wird. Darüber hinaus ist die Zahl Bi eine ganze Zahl und größer oder auch gleich Null und dient dazu insbesondere im Falle einer Wahl einer Primzahl von xi gleich Null trotzdem einen Bildregisterwert zu ermitteln, welcher genau dem Wert der ganzen Zahl Bi entspricht. Ist nun xi gleich Null, so entspricht der Bildregisterwert xci daher der Gleichung xci = Bi. Insofern ist verhindert, dass von extern ein ungewollter Zugriff von einem Registerwert xi=0 unkontrolliert stattfinden kann, da die Einführung der Primzahl Ai in der Codierungsvorschrift aufgrund der Multiplikation mit dem Wert Null stets auch wiederum Null ergibt.Furthermore, it can be seen that for access and / or data flow control in a data transfer channel an access checking module 4 between the storage unit 2 and the processing unit 3 is interposed. Where is the access check module 4 set up and provided register values xi of register cells R of the processing unit (CPU) 3 with the destination storage class 21 a uniquely assigned prime number Ai according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

to multiply. It always applies to all variables that i is greater than zero and an integer. In particular, an image register value, which is described by means of the encoding rule described here xci to be determined which only in this image register value xci uniquely assigned destination storage class 21 according to the respective prime number Ai is deposited. In addition, the number Bi is an integer and greater than or equal to zero and is used in particular in the case of a choice of a prime number of xi equal to zero, nevertheless, to determine an image register value which exactly matches the value of the integer Bi equivalent. If xi is equal to zero, then the image register value corresponds xci Hence, the equation xci = Bi. Insofar, prevents unwanted access from a register value externally xi = 0 can take place unchecked, since the introduction of the prime number Ai always returns zero in the coding rule due to the multiplication by the value zero.

In other words, it is excluded that an image register value xci also when selecting the register value xi in turn, zero equals zero. Both register values are therefore different from each other. This is also the basic principle, since it can generally be said that an image register value must be chosen differently from a register value in order to achieve a coding.

In particular, the access check module described here recognizes 4 if an image register value xci , uniquely assigned to a prime number Ai and a target storage class 21 , into another target storage class, uniquely a different prime number Ai is assigned, stored and / or the access check module 4 also prevents filing this image register value xci in this other destination storage class 21 , Like from the 1A can be further recognized includes the Access Check Module 4 a multiplier module 41 as well as a division module 42 , where the multiplier module 41 to multiply the respective prime number Ai with a register value Ri associated with one of these prime numbers and with addition of the integer Bi serves and is set up and the divisional module 42 for dividing the respective image register value xci is trained. In this respect, after coding and transformation of the register value xi in the image register value xci by the division module a corresponding mathematical inverse transformation starting from the image register value xci in the original register value x very simple and one-to-one. The primes Ai Namely have the advantage that not unintentionally other factors or fractions from the fractions after division by the division module 42 but always immediately in turn the original register value Ri (bidirectionality).
Accordingly, in 1B illustrated that by introducing the primes Ai is excluded, non-integer multiples of original register values xi in the target storage classes 21 in the form of the image register values xci be filed. The access exam module 4 ensures that always only integer multiples of primes Ai be formed. Corresponding values between integer multiples of the primes are therefore excluded.

In this respect, each target storage class 21 one-by-one a prime number Ai assigned. For example, if you want a date in the storage device 2 This is done using the above coding rule and the prime number Ai coded. The result is therefore subsequently stored in the memory unit. When reading, the date is divided by division using the above division module 42 by the corresponding prime number Ai retransformed (to English valid). If there is a remainder in this operation, it would be divided by an invalid prime number, thus giving access to an incorrect target storage class 21 (to invalid). As a result, an unwanted influence on the different storage classes can be detected. Corruption of the storage unit is therefore particularly easy to recognize.

In other words, the controller unit described in the above invention provides 1 In general, the advantages that any number of target storage classes can be specifically addressed and encapsulation within one is possible. In particular, the controller unit described here 1 Hardware-independent also for low-performance operating systems without MPU systems are operated. The controller unit described here 1 In fact, it does not require complex and costly different processors, but can already be operated with a very low processor clock speed.

In addition, the controller unit described here can be operated independently, since the controller unit described here 1 based on a generic concept.

Further, there is no need for a dedicated OS to support an MPU, resulting in immediate cost savings and allowing targeted read accesses to other areas and using the corresponding "key" (prime number) (as noted above in embodiments). This offers the advantages that no special overlapping memory cell areas are necessary, no reconfiguration of the MPU is necessary and also that no complete read release to a complete area of the memory unit across all target memory classes is necessary.

In addition, by means of the controller unit described here 1 a simplified testing be realized because regardless of specific hardware mechanisms, the controller unit 1 can be operated.

LIST OF REFERENCE NUMBERS

1

controller unit

2

storage unit

3

processing unit

4

Zugriffsprüfmodul

21

Target storage class

41

multiplier module

42

Division module

FCT

executive function

Ai

Prime number

xi

register value

xci

Image Register

Bi

integer greater than or equal to zero

Claims (8)

Controller unit (1) for non-reactive access and / or data flow control between at least one memory unit (2) and at least one processing unit (3) (CPU), comprising at least one memory unit (2) and at least one processing unit (3), wherein the memory unit (2 ) comprises at least two target memory classes (21) in which at least one execution function (FKT) is stored and / or executable and each execution function (FKT) is uniquely assigned in that each execution function (FKT) is associated with at least one target storage class (21) for access and / or data flow control in a data transfer channel, at least one access checking module (4) is interposed between the memory unit (2) and the processing unit (3), characterized in that each target memory class (21) has an exactly one positive prime number (Ai; i> = 0), the access check module (4) being set up and d a, register values (xi; i> = 0) of register cells (R) of the processing unit (3) (CPU) with the target memory class (21) a unique associated prime number (Ai) according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

xci is an image register value and is stored only in the respective target memory class (21) corresponding to the respective prime number (Ai) and Bi is an integer greater than or equal to zero, whereby when reading an image register value (xci) from the target memory classes (Ai) 21) this image register value is divided by the prime number (Ai) uniquely assigned to each image register value, the resulting register value being read only into its associated register cell so that the access test module (4) recognizes when the register value, uniquely assigned to a register cell, into one another register cell, uniquely assigned to another register value, is stored and / or the access checking module (4) prevents the register value from being stored in the other register cell. Controller unit (1) according to Claim 1 characterized in that the access checking module (4) detects when an image register value uniquely assigned to a prime number and a destination storage class (21) is stored in another destination storage class (21) uniquely assigned to another prime number and / or the access check module (4 ) prevents filing this image register value in this other destination storage class (21). Controller unit (1) according to Claim 1 or 2 , characterized in that upon detection an erroneous assignment the Access Check Module (4) outputs at least one error message. Controller unit (1) according to at least one of the preceding claims, characterized in that the access checking module (4) at least one multiplier module (41) for multiplying the respective prime number with a register value assigned to this prime number and for addition of the integer (Bi) and / or at least a division module (42) for dividing the respective image register value. Controller unit (1) according to at least one of the preceding claims, characterized in that the access checking module (4) is designed to permit access by an execution function (FKT) which is stored in a destination storage class (21) to be predefined to at least one other destination storage class (21 ). Controller unit (1) according to the preceding claim, characterized in that an execution function (FKT) of a target storage class (21) has access to a predefinable selection from all or a spectrum of the existing target storage classes (21). Controller unit (1) according to at least one of the preceding claims, characterized in that one and the same execution function (FKT) is stored identically in at least two target memory classes (21) and / or from one and the same execution function (FKT) on at least two target memory classes (21). can be accessed. Method for feedback-free access and / or data flow control between at least one memory unit (2) and at least one processing unit (CPU), using at least one memory unit (2) and at least one processing unit (3), the memory unit (2) at least two target memory classes (21), in each of which at least one execution function (FKT) is stored and / or executable and each execution function (FKT) is uniquely associated in that each execution function (FKT) is associated with at least one target storage class (21), wherein the Access control and / or data flow control in a data transfer channel at least one access checking module (4) between the memory unit (2) and the processing unit (3) is interposed, characterized in that each target storage class (21) one and only one positive prime number (Ai; i> = 0), the access checking module (4) being set up and daz u, register values (xi; i> = 0) of register cells (R) of the processing unit (3) (CPU) with the target memory class (21) a unique associated prime number (Ai) according to a coding rule $$\text{xci}=\text{Ai}*\text{xi}+\text{Bi}$$

xci is an image register value and is stored only in the respective target memory class (21) corresponding to the respective prime number (Ai) and Bi is an integer greater than or equal to zero, whereby when reading an image register value (xci) from the target memory classes (Ai) 21) this image register value is divided by the prime number (Ai) uniquely assigned to each image register value, the resulting register value being read only into its associated register cell so that the access test module (4) recognizes when the register value, uniquely assigned to a register cell, into one another register cell, uniquely assigned to another register value, is stored and / or the access checking module (4) prevents the register value from being stored in the other register cell.

Images