KR102084778B1 - Access control method and apparutus thereof - Google Patents

Abstract

The present invention relates to an access control device implemented in a web server, a login page generator for generating a login page to run on one process of a specific application; An access time measuring unit measuring a write access time, which is a time taken by a kernel of an operating system to write data corresponding to the login access attempt to a page of a physical memory area when a client attempts to access the login; And an access control unit determining whether to allow the client to access based on the information on the Write Access Time received from the access time measurement unit.

Description

ACCESS CONTROL METHOD AND APPARUTUS THEREOF}

The present invention relates to an access control method and apparatus, and more particularly, to an access control method and apparatus using a memory deduplication technique.

The importance and value of how to identify a client in an Internet environment targeting an unspecified number of people is increasing. However, due to the development of various camouflage and concealment means and limitations of existing security technologies, the identification of clients is very difficult in reality.

As a result, security problems, large and small, continue to occur online today. Phishing, the most common security problem, continues to evolve and has become more sophisticated in recent years, making it very difficult for the general public to identify and defend against phishing sites. In addition, not only phishing, but also other intrusion methods are becoming more sophisticated, and interest in defense solutions is gradually increasing.

When a malicious user invades a network of a service provider and spreads a virus or leaks personal information, the damage caused by it is serious, and it is also difficult to track who was connected at the time. Therefore, the web server operator needs to identify (authenticate) clients visiting the web server in order to block the access of the black accessor maliciously accessing the network.

To identify these clients, a virtual private network (VPN), multi-factor authentication (MFA), integrated threat management system (Unified Threat Management) along with an account login (ID / PW) method via a web page , UTM). However, some web server operators do not apply additional security solutions other than the account login method due to economic and policy reasons. Therefore, when only the account login method through the web page is applied, it is necessary to prevent a malicious user from bypassing the web page and accessing the web site.

The present invention aims to solve the above and other problems. Another object is to provide an access control method and apparatus for effectively blocking abnormal login access to a web server using a memory deduplication technology.

Another object is to provide a web server having an access control device using a memory deduplication technology.

According to an aspect of the present invention to achieve the above or other object, a login page generation unit for generating a login page to run on a process of a specific application; An access time measuring unit measuring a Write Access Time, which is the time it takes for the kernel of the operating system to write data corresponding to the login access attempt to a page in the physical memory area when the client attempts to access the login; And an access control unit determining whether to allow the client to access based on the information on the Write Access Time received from the access time measurement unit.

According to another aspect of the present invention, the step of generating a login page to run on one process of a specific application in advance; Measuring a Write Access Time, which is the time it takes for the kernel of the operating system to write data corresponding to the login access attempt to the page of the physical memory area when the client attempts to access the login; And determining whether to allow the client to access based on the measured Write Access Time information.

According to another aspect of the invention, the process of generating in advance a login page to run on one process of a specific application; Measuring a Write Access Time, which is the time it takes for the kernel of the operating system to write data corresponding to the login access attempt to the page of the physical memory area when the client attempts to access the login; And a program stored in a computer-readable recording medium so that a process of determining whether or not the client is allowed to access based on the measured Write Access Time information is executable on a computer.

The effects of the access control method and the device according to the embodiments of the present invention are as follows.

According to at least one of the embodiments of the present invention, by using an access control method using a memory deduplication technique as an additional security enhancement means, it is possible to block a malicious user from bypassing a login page and accessing a web server. .

According to at least one of the embodiments of the present invention, by using an access control method using a memory deduplication technique as an additional security enhancement means, it is possible to reduce the time and cost required to build a separate security solution on a web server There is this.

However, the access control method according to the embodiments of the present invention and the effect that the device can achieve are not limited to those mentioned above, and other effects not mentioned in the technical field to which the present invention belongs from the following description It will be clearly understood by those with ordinary knowledge.

1 is a view showing a web service providing system according to an embodiment of the present invention;
2 is a view showing an operating system of a web server according to an embodiment of the present invention;
3 to 5 are diagrams referenced to describe a memory deduplication technique;
6 and 7 are views for explaining a difference in Write Access Time due to Copy On Write in the memory deduplication technology;
8 is a block diagram of an access control apparatus according to an embodiment of the present invention;
9 is a diagram referred to describe Write Access Time when a malicious user attempts to access by bypassing a login page;
10 is a view referred to describe a Write Access Time when a terminal user attempts to access through a login page;
11 is a flowchart illustrating a method of controlling access according to an embodiment of the present invention.

Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, but the same or similar elements are assigned the same reference numbers regardless of the reference numerals, and overlapping descriptions thereof will be omitted. The suffixes "modules" and "parts" for the components used in the following description are given or mixed only considering the ease of writing the specification, and do not have meanings or roles distinguished from each other in themselves. That is, the term 'unit' used in the present invention refers to a hardware component such as software, FPGA or ASIC, and 'unit' performs certain roles. However, 'wealth' is not limited to software or hardware. The 'unit' may be configured to be in an addressable storage medium or may be configured to reproduce one or more processors. Thus, as an example, 'part' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, attributes, procedures, Includes subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, database, data structures, tables, arrays and variables. The functionality provided within components and 'parts' may be combined into a smaller number of components and 'parts' or further separated into additional components and 'parts'.

In addition, in describing the embodiments disclosed in the present specification, when it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed herein, detailed descriptions thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed in the specification is not limited by the accompanying drawings, and all modifications included in the spirit and technical scope of the present invention , It should be understood to include equivalents or substitutes.

The present invention proposes an access control method and apparatus capable of effectively blocking abnormal login access to a web server using a memory deduplication technique.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the drawings.

1 is a view showing a web service providing system according to an embodiment of the present invention.

Referring to FIG. 1, the web service providing system 10 according to the present invention may include a communication network 100, a web server 200, a user information DB 300 and a user terminal 400.

The user terminal 400 and the web server 200 may be connected to each other through the communication network 100. The communication network 100 may include a wired network and a wireless network, specifically, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), and the like. It can include a variety of networks. In addition, the communication network 100 may include a known World Wide Web (WWW). However, the communication network 100 according to the present invention is not limited to the networks listed above, and may include at least one of a known wireless data network, a known telephone network, and a known wired / wireless television network.

The user terminal 400 may access the web server 200 by driving a web browser according to a user command or the like. At this time, in order for the user terminal 400 to access the web server 200, a series of user authentication processes (eg, a login process) are required.

When the user authentication is successful, the user terminal 400 may provide various web services based on information and / or contents provided from the web server 200.

The user terminal 400 described herein includes a mobile phone, a smart phone, a navigation terminal, a laptop computer, a digital broadcasting terminal, personal digital assistants (PDAs), portable multimedia player (PMP), navigation, Desktop PC, slate PC, tablet PC, ultrabook, wearable device, e.g., smartwatch, smart glass ), HMD (head mounted display), and the like.

The user information DB 300 may store and manage user authentication information for identifying terminal users subscribed to the web server 200. Here, the user authentication information may include ID information and password information of terminal users, but is not limited thereto.

The web server 200 may control access of the user terminal 400 by using user authentication information (that is, login information) stored in the user information DB 300. For example, when the login information is input through the login page provided by the web server 200, the web server 200 compares the login information entered through the login page with the login information stored in the user information DB 300, and the user terminal. The access of the 400 may be allowed or the access of the corresponding terminal 400 may be blocked.

Meanwhile, in the present exemplary embodiment, it is illustrated that the access of the user terminal 400 is controlled through an authentication module (not shown) provided in the web server 200, but is not limited thereto. Accordingly, the web server 200 may control access of the user terminal 400 in conjunction with a separate authentication server (not shown).

In addition to the access control method using the login page, the web server 200 may further enhance the login security by additionally using the access control method using the memory deduplication technology. This is to prevent a malicious user from bypassing the login page and accessing the web server 200.

If the above-described access control methods are performed simultaneously or sequentially, and all security authentication is successful, the web server 200 allows access to the user terminal 400 and can provide the web service requested by the terminal 400. have.

On the other hand, in the following, the memory deduplication technique (Memory Deduplication Technique) used in the access control method according to a preferred embodiment of the present invention, the Copy On Write process occurring in the memory deduplication technology, and the Copy On Write process The increased write access time will be described in detail.

2 is a view showing an operating system of a web server according to an embodiment of the present invention.

Referring to FIG. 2, the web server 200 according to the present invention may include a plurality of applications (applications, 210), an operating system (operating system 220), and hardware (hardware, 230).

The plurality of applications 210 are various application programs for performing basic operations of the web server 200. The web server 200 may perform various operations related to the web service requested by the user terminal 400 using these applications.

The plurality of applications 210 includes an application that provides a web service, an application that controls access to the user terminal using account login information, an application that controls access to the user terminal 400 using memory deduplication technology, and the like. It may include.

The hardware 230 refers to a computer or peripheral devices thereof, and may include a central processing unit (CPU), memory, and other devices.

The central processing unit (CPU) receives information from outside, stores it, interprets computer program instructions, calculates them, and outputs them to the outside. The central processing unit (CPU) may be composed of a control unit, a computing unit, and registers.

The memory performs a function of storing data supporting various functions of the web server 200. In addition, the memory may store a plurality of application programs (application programs or applications) running on the web server 200, data and instructions for the operation of the web server 200.

The memory includes flash memory type, hard disk type, solid state disk type, SDD type (Silicon Disk Drive type), multimedia card micro type, and card Type of memory (e.g. SD or XD memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM) ), PROM (programmable read-only memory), magnetic memory, magnetic disks, and optical disks.

The operating system 220 is system software that serves as an interface between a plurality of applications 210 and hardware 230.

The operating system 220 is a kernel that manages hardware resources and provides an execution environment for software, a system call that provides an interface to the kernel, and a shell that is responsible for processing user commands. ). Since the kernel is the most important core component of the operating system 220, the kernel is also referred to as an operating system.

The operating system 220 may perform various functions such as a process management function (eg, synchronization function, scheduling function, etc.), hardware management function, and hardware and process security function.

The operating system 220 may perform a memory management function to reduce system overhead and optimize system performance. That is, the operating system 220 may perform an operation of allocating memory space to currently running processes and reclaiming the allocated memory space when the processes are terminated.

The memory management techniques used in the operating system 220 include a Contiguous Memory Allocation (CMA) technique, a paging technique, a segmentation technique, and a memory deduplication technique.

The memory deduplication method used in the present invention is a technique for efficiently managing limited memory resources by mapping virtual address spaces having the same contents onto one physical memory page. For example, a memory deduplication technology called Kernel Same-page Merging (KSM) is used in a Linux operating system (Linux OS).

3 to 5 are diagrams referred to for describing a memory deduplication technique.

3 to 5, at least one application 310 installed in the web server 200 may perform a specific function using virtual memory.

When the first function of the application 310 is executed, the first data corresponding to the first function is stored in the first virtual address area 311 allocated to the application 310, and the second function of the application 310 When the function is executed, the second data corresponding to the second function is stored in the second virtual address area 312 allocated to the application 310.

As shown in FIG. 3, when the contents of the first data and the contents of the second data are different from each other, the operating system 320 sets the first virtual address area 311 to page A 331 of the physical memory area 330. And mapping the second virtual address area 312 to page B 332 of the physical memory area 330 to allocate physical memory resources to the corresponding application 310.

Meanwhile, as illustrated in FIG. 4, when the contents of the first data and the contents of the second data are identical to each other, the operating system 320 is configured to efficiently manage limited memory resources without affecting the currently running application. Physical deduplication technology can be used to allocate physical memory resources.

That is, the operating system 320 maps the first virtual address area 311 to page C 333 of the physical memory area 330, and the second virtual address area 312 also maps to the same page C 333. You can share physical memory resources. In this case, the page 333 that has been deduplicated can be set as a copy on write (COW) page, meaning that it is possible to read pages but not write. For convenience of description below, a page 333 merged into one page through memory deduplication is referred to as a shared page or a deduplicated page. It is referred to as a page (a normal page or a non-deduplicated page).

As described above, when the physical memory area 330 is deduplicated, when the process of the application 310 modifies (Write Access) the second data stored in the second virtual address area 312, the first virtual address area The identity between the first data stored in 311 and the second data stored in the second virtual address area 312 is broken, and accordingly, the physical memory area can no longer be shared.

In this case, the operating system 320 cannot modify the shared page 333 indicated by the second virtual address area 312, and must copy the shared page 333 and then write to the copied page. do. For example, as shown in FIG. 5, the operating system 320 creates a new page D 334 by copying the shared page 333 and writes data 313 corresponding to the modification to the page D 334. do. To this end, the operating system 320 changes the physical memory area 330 corresponding to the second virtual address area 312 from a shared page (ie, pages C and 333) to a copy page (ie, pages D and 334). do.

As described above, a process in which memory deduplication is canceled while the identity between data stored in different virtual address areas is broken is referred to as 'Copy On Write (COW)'. Due to the Copy On Write (COW), a difference in Write Access Time for a memory page occurs.

6 and 7 are diagrams referred to explain differences in Write Access Time due to Copy On Write in the memory deduplication technology.

Referring to FIG. 6, at least one application 610 installed in the web server 200 may perform a specific function using a virtual memory.

When a specific function of the corresponding application 610 is executed, data corresponding to the specific function is stored in the virtual address area 611 allocated to the application 310. The operating system 620 allocates the physical memory resource to the corresponding application 610 by mapping the virtual address area 611 to page A 631 of the physical memory area 630. Here, page A 631 is a general page to which memory deduplication is not applied.

When the physical memory area 630 is allocated and the process of the corresponding application 610 corrects (Write Access) data stored in the virtual address area 611, the operating system 320 determines that the virtual address area 611 is The page A 631 of the physical memory area 630 indicated is corrected.

In response to the request for modification of the process, the time taken by the operating system 620 to write data to page A 631 of the physical memory area 630 is' Write to a non-deduplicated page. Access Time '. For example, the write access time for a non-deduplicated page may take about 10 ms to 15 ms.

Meanwhile, referring to FIG. 7, at least one application 710 installed in the web server 200 may perform a specific function using a virtual memory.

When the first function of the application 710 is executed, the first data corresponding to the first function is stored in the first virtual address area 711 assigned to the application 710, and the second function of the application 710 is When the function is executed, the second data corresponding to the second function is stored in the second virtual address area 712 assigned to the application 710.

When the content of the first data and the content of the second data are the same, the operating system 720 maps the first virtual address area 711 to page A 731 of the physical memory area 730, and the second virtual address The regions 712 can also share physical memory resources by mapping to the same page A 731.

When the physical memory area 730 is deduplicated and the process of the corresponding application 710 corrects the second data stored in the second virtual address area 712 (Write Access), the operating system 320 is the second You cannot modify the shared page (i.e., pages A, 731) indicated by the virtual address area 712, copy the shared page 731, and then modify it to the copy page (i.e., pages B, 732). write). To this end, the operating system 720 changes the physical memory area 730 corresponding to the second virtual address area 712 from a shared page (ie, pages A and 731) to a copy page (ie, pages B and 732). do.

In response to the request for modification of the process, the time required for the operating system 720 to write data to the shared page 731 of the physical memory area 730 is' Write Access Time for a deduplicated page. It is called '.

A shared page (a deduplicated page) because the Copy On Write (COP) that occurs when deduplication of memory occurs causes additional time to copy the shared page and map the virtual address area to the copy page of the physical memory area. Write Access Time for is longer than Write Access Time for a non-deduplicated page. For example, Write Access Time for a deduplicated page may take approximately 40 ms.

As described above, when the memory is managed by the operating system using memory deduplication, the Write Access Time for a non-deduplicated page and the Write Access Time for a deduplicated page are always shown below. The relationship of Equation 1 is satisfied.

8 is a block diagram of an access control device according to an embodiment of the present invention.

Referring to FIG. 8, the access control device 800 according to the present invention may include a login page generation unit 810, an access time measurement unit 820, and an access control unit 830. The access control device 800 may be implemented in the web server 200 to identify clients.

The login page generator 810 may generate a login page to be driven as a background on one process of an application installed on the web server 200. Here, the login page means a web page for entering login account information of the terminal user.

When the login page is generated by the login page generator 800, the operating system of the web server 200 stores data corresponding to the login page in the virtual address area of the corresponding process, and the virtual address area is specified in the physical memory area. Will map to the page.

The access time measurement unit 820 may measure a time (that is, Write Access Time) for the kernel of the operating system to write data corresponding to the login access attempt to the page of the physical memory area when the login access is attempted. The access time measurement unit 820 may provide information on the measured Write Access Time to the access control unit 830.

The access control unit 830 may determine whether to allow the user terminal 400 to access based on the information on the Write Access Time received from the access time measurement unit 820.

The access control device 800 according to the present invention, when a terminal user accesses the web server 200 through a login page and a write access time when a malicious user bypasses the login page and accesses the web server 200 Given that the Write Access Time is different from each other, it is possible to determine whether to allow the access of the user terminal 400.

9 is a view referred to describe Write Access Time when a malicious user attempts to access by bypassing the login page, and FIG. 10 shows Write Access Time when a terminal user attempts to access through the login page. It is a drawing referred to for explanation.

Referring to FIG. 9, the first process of the application 910 installed in the web server 200 may perform a function of generating a login page using virtual memory.

When the login page generation function is executed through the first process, data corresponding to the login page is stored in the first virtual address area 911 allocated to the first process. The operating system 920 allocates physical memory resources to the first process by mapping the first virtual address area 911 to page A 931 of the physical memory area 930.

When the login page is running in the background through the first process and the malicious user bypasses the login page through the second process to execute the function of accessing, the second virtual address area 912 allocated to the second process The data corresponding to the function is stored. Since the data stored in the first virtual address area 911 and the data stored in the second virtual address area 912 are not identical to each other, the operating system 920 sets the second virtual address area 912 to the physical memory area 930. Physical memory resources are allocated to the second process by mapping to page B 932 of. Here, page B 932 is a general page to which memory deduplication is not applied.

When the physical memory area 930 is allocated as described above, when a malicious user writes data stored in the second virtual address area 912 to access the web server 200, the operating system 320 ) Modifies page B 932 of the physical memory area 930 indicated by the second virtual address area 912. Therefore, the write access time when a malicious user tries to access by bypassing the login page corresponds to the write access time for the general page.

Meanwhile, referring to FIG. 10, the first process of the application 1010 installed in the web server 200 may perform a function of generating a login page using virtual memory.

When the login page generation function is executed through the first process, data corresponding to the login page is stored in the first virtual address area 1011 allocated to the first process. The operating system 1020 allocates physical memory resources to the first process by mapping the first virtual address area 1011 to page A 1031 of the physical memory area 1030.

When the login page is running in the background through the first process and a normal user accesses the website through the second process and calls the same login page, the second virtual address area 1012 allocated to the second process The data corresponding to the login page is stored. Since the data stored in the first virtual address area 1011 and the data stored in the second virtual address area 1012 are identical to each other, the operating system 1020 sets the second virtual address area 1012 to the physical memory area 1030. By mapping to page A 1031, physical memory resources are shared.

As described above, when the physical memory area 1030 is deduplicated, when the terminal user modifies data stored in the second virtual address area 1012 (that is, when login information is input to the login page), the first virtual The identity between the data stored in the address area 1011 and the data stored in the second virtual address area 1012 is broken. In this case, the operating system 1020 copies a shared page (ie, pages A and 1031) indicated by the second virtual address area 1012 and then writes it to the copy page (ie, pages B and 1032). ). Therefore, the Write Access Time when a normal user tries to access through the login page corresponds to the Write Access Time for the shared page. As described above, due to the Copy On Write (COW) process, the Write Access Time for the shared page is longer than the Write Access Time for the general page.

Referring again to FIG. 8, the access control unit 830, when the Write Access Time received from the access time measurement unit 820 corresponds to the Write Access Time for the shared page, the user terminal 400 logs in normally It is determined that the user has accessed through the page, and access to the web server 200 may be allowed.

On the other hand, the access control unit 830, if the Write Access Time received from the access time measuring unit 820 corresponds to the Write Access Time for the general page, it is determined that the malicious user bypassed the login page to access Access to the web server 200 may be blocked.

As described above, the access control device according to the present invention can effectively block a malicious user from bypassing a login page and accessing a web server by using an access control method using a memory deduplication technique as an additional security enhancement means. have.

11 is a flowchart illustrating a procedure of an access control method according to an embodiment of the present invention.

Referring to FIG. 11, the access control device 800 according to the present invention may generate a login page to be driven in the background in advance on the security process of the web server 200 (S1110). At this time, the operating system of the web server 200 stores the data corresponding to the login page in the virtual address area of the corresponding process, and maps the virtual address area to a specific page of the physical memory area.

When a normal user or a malicious user attempts login access to the web server 200 (S1120), the access control device 800 takes the kernel of the operating system to write data corresponding to the login access attempt to the page of the physical memory area. Time (Write Access Time) may be measured (S1130).

As a result of the measurement, when the Write Access Time exists in the first threshold range (S1140), the access control device 800 may determine that a normal user accesses through a login page and allow access to the web server 200. Yes (S1150). Here, the first threshold range represents an average range of Write Access Time for a deduplicated page.

On the other hand, if the Write Access Time is in the second threshold range (S1160), the access control device 800 may block access to the web server 200 by determining that a malicious user bypasses the login page to access. (S1170). Here, the second threshold range represents the average range of Write Access Time for a non-deduplicated page.

The above-described present invention can be embodied as computer readable codes on a medium on which a program is recorded. The computer-readable medium, continue to store executable computer program, or may be temporarily stored for a run or download. In addition, the medium may be one which can be a variety of recording device or storage means of a single or several hardware combined form, is not limited to the medium to be directly connected to any computer system, there distributed to the network. Examples of the medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks, And program instructions including ROM, RAM, flash memory, and the like. In addition, the media can be recorded to storage media managed as an example for other media, website, etc. supplied to the app store or other retail distributor of various software applications, and servers. Accordingly, the above detailed description should not be construed as limiting in all respects, but should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

10: web service providing system 100: communication network
200: Web server 300: User information DB
400: user terminal 210: applications
220: operating system 230: hardware
800: access control device 810: login page generator
820: access time measurement unit 830: access control unit

Claims (13)

A login page generation unit that generates a login page to be run on one process of a specific application;
An access time measuring unit measuring a Write Access Time, which is the time it takes for the kernel of the operating system to write data corresponding to the login access attempt to a page in the physical memory area when the client attempts to access the login; And
And an access control unit determining whether to allow the client to access based on the information on the Write Access Time received from the access time measurement unit.
The login page is used to generate a shared page (deduplicated page) for memory deduplication in the physical memory area, characterized in that the access control device. According to claim 1,
The specific application is an access control device, characterized in that the application to control the access of the client using a memory deduplication technique (Memory Deduplication Technique). According to claim 1,
The login page, the access control device, characterized in that the web page for entering the login account information of the client. delete According to claim 1,
The access control unit, if the Write Access Time is within the first threshold range, the access control device, characterized in that to allow the login access by determining that the client access through a normal login page. The method of claim 5,
When the client attempts to access through a normal login page, the Write Access Time corresponds to the Write Access Time for the shared page. The method of claim 6,
The first threshold range, access control device characterized in that it represents a range of Write Access Time for the shared page. According to claim 1,
The access control unit, if the Write Access Time is in the second threshold range, the access control device, characterized in that to block the login access by determining that the client access by bypassing the login page. The method of claim 8,
When the client attempts to access by bypassing the login page, the Write Access Time corresponds to the Write Access Time for a non-deduplicated page. The method of claim 9,
The second threshold range, access control device characterized in that it represents a range of Write Access Time for the general page. A web server having an access control device according to any one of claims 1 to 3 and 5 to 10. Generating in advance a login page to be run on one process of a specific application;
Measuring a Write Access Time, which is the time it takes for the kernel of the operating system to write data corresponding to the login access attempt to the page of the physical memory area when the client attempts to access the login; And
And determining whether to allow the client to access based on the measured Write Access Time information.
The login page is used to create a shared page (deduplicated page) for deduplication of memory in the physical memory area. A computer program stored on a computer readable recording medium so that the method according to claim 12 is computer executable.

Images