NO822813L - DEVICE FOR AUTOMATICALLY DELETING THE INFORMATION CONTENT IN DATABASES - Google Patents

Description

DEVICE FOR AUTOMATIC DELETE OF THE INFORMATION CONTENT I

DATABASES

TECHNICAL AREA

The invention relates to a device in databases to prevent

that someone gains unlawful access to or misuses the information content in the database.

STATE OF THE ART

In databases where the information content is confidential or

laughs secretly, there is always a risk of sabotage or unauthorized access to the information. Access to data in such facilities is normally restricted in various ways, e.g. at classification terminals, encryption of data during data transmission or use of one or another system with key words. The facilities are also guarded and arranged in protected premises.

Despite this, there is a risk of groups occupying a facility. It can then be difficult to protect data and the installation's functions. In such extreme cases, it is sometimes prescribed that the entire installation be blown up.

ACCOUNT OF THE INVENTION

The problem with known techniques is, of course, that in manned

those facilities there is a great risk of personnel being injured in the event of a possible explosion, and it is also possible that some valuable equipment will be destroyed unnecessarily. Furthermore, it has proven to be very difficult to destroy data stored on tapes or tape cartridges in a sufficiently efficient manner.

The invention, which is characterized in the claim, solves this problem by supplying the database with a special button, a p.

k. disaster button, which in an activated state gives electrical pulses to an electronic circuit which in a first step

ter all data information in the database and then in a second step deletes all. program information in the database.

The advantage of the device according to the invention, compared to known devices, is that the entire installation can be rendered unusable without material destruction and without the personnel being exposed to danger. Once the data information is erased, the contents of tapes, cassettes or disc memories cannot. can be read in other computers. Once all programs have been deleted, the database cannot be used to spread false information either. With the device according to the invention, a technically simpler and economically more advantageous solution has been achieved than with the known devices.

BRIEF DESCRIPTION OF THE DRAWING

The device according to the invention is described in more detail below with reference to an embodiment shown in the attached drawing, which shows a block core of a device according to the invention.

PREFERRED EMBODIMENT

As will be apparent from the figure, the device according to the invention is part of a database installation, which comprises a computer system of a known type, e.g. as discussed in AX 10 System Survey, LME 118708, where a computer controls writing and reading in connected data memories and program memories. Such writing and reading are known techniques and are not covered by the invention idea, but are mentioned to facilitate an assessment of the device. In database installations, data and program memories can e.g. be tape memories, cassette memories, disc memories, semiconductor memories, etc.

In the installation according to the invention, there are a number of data memories DSl-DSn for storing the information that the database works with. The memories can be of different types and can also contain different types of information, i.e. they can be considered as mutually independent functional units. A number of additional memories are also included

in the database, there are program memories PSl-PSn. These memories can also form mutually independent functional units.

The programs that control the processes in the database are stored in the memories PSl-PSn. All memories, data memories, as well as program memories receive write and read commands from a computer CPU, which is connected to, but not shown in the figure. By dividing the memories into functional units, very short access times are achieved. As both data and program information in a database can be of great value to a hacker or an attacker, the facility must, in addition to purely physical protection, have an option to prevent unauthorized access to the important information which is stored in the memories - As previously mentioned, blowing up the plant is a method that is both dangerous and unsafe. The device according to the invention enables efficient elimination of data and programs by deletion, so that neither personnel nor equipment are put at risk.

The figure also shows that the device according to the invention comprises address generators ADl-ADn and APl-APn, respectively, which are separately connected to the address inputs for each data store DS1-. DSn and program stores'PSl-PSn, to designate each memory location occurring in connected memory. Gate circuits

■ GDl^-GDn^ and GPlj-GPn^ are connected to the memory's data inputs, from which gates logic zeros are written into each position at a designated address in the memory, when the memory receives a write pulse on a write input W. The idea of erasure is such that for each designated address in the memory only zeros are written in the designated positions, regardless of what was written there before and until the entire memory is

filled with zeros.

The figure shows that the output from an operating point MO is connected to the setting input ("set-input") of a bistable flip-flop SRI, which in the activated state has the task of emitting a signal with a determined logic level as long as no activation signal is fed into the flip-flop's reset input. The flip-flop's output is connected to the inputs for a number of address generators ADl-ADn of type 74 LS 191 from TEXAS INSTRUMENTS. Each address generator has its outputs separately connected to the address inputs for a corresponding data memory1

DSl-DSn made by INTEL type 2114 L. The address generators' task, when they are activated and controlled by a clock CL common to the system, is to generate all addresses that can occur in associated data memory, and in turn point out each address in the memory . In the embodiment example, it is assumed that each word stored in the memory consists of 4 bits, although the memories can of course also be constructed for other word lengths, e.g. 8 pieces. However, this has no influence on the principle of deletion. The output of a gate circuit GD1-^-GDn^ is connected to each data input for each data memory DS1-DSn. The gate circuits are logical 0G circuits of make NATIONAL type 7 4 LS 02, provided with two .. inputs, one of which is inverting. The output from said flip-flop SRI is connected to all said inverter end inputs for the AND circuits. The other input of each AND circuit is connected to a data bus DB, which is common to the memories and by means of which communication is maintained between the computer CPU and the memories DS1-DSn. According to the embodiment example, the computer can be a microprocessor of the make MOTOROLA type MC 68000. The output of the flip-flop SRI is also connected to one of the inputs of an OR circuit ORl-ORn, the other input of which is fed from the computer CPU. The outputs from the aforementioned OR circuits are connected to the write input for the respective connected data memory. A register RDl-RDn of make INSTRUMENTS type 7 4LS17 4 is connected to the data outputs for each data memory. The register contains as many positions as the data word, i.e. 4 in the selected case. The outputs from the registers are connected to corresponding inputs for AND circuits OQ1-ODn, whose outputs are inverting and connected to the inputs of a further AND circuit '02. The circuit 02 has as many inputs as the number of AND circuits ODl-ODn, which in turn depends on the number of data memories. In the chosen embodiment, the number of memories is two DSl-DSn, which means two AND circuits ODl-ODn and consequently two inputs for the circuit 02. As can be seen from the designation of the memories,

Of course there may be more than two memories.

A counter Cl, which is common to all data memories, is also

then connected to the output of the flip-flop SRI. Controlled by the system clock

Cl, this counter sends a read pulse to the data memory, when the last position in the data memory is designated, so that the word in the last position of the data memory is read out to the respective registers RDl-RDn. In order to prevent data from being read out of the memory from any other address than the last selected during deletion, blocking circuits Bl-Bn are connected to the read inputs for the data memories. The blocking circuits consist of AND circuits, one of whose inputs is inverting and which is connected to the output of the flip-flop SRI. The second input for the circuits Bl-Bn is fed from the computer CPU, which under normal conditions gives a read pulse to this input. The output of the 0G circuit 02 is connected to the setting input of another bistable flip-flop SR2 of the same type as the flip-flop SRI and. its output feeds, in the same way as the output from the flip-flop SRI, an exactly identical electronic circuit, which controls the work towards the data memories, but this circuit is now intended for the program memories PSl-PSn, which are of the same type as the data memories. The output from the flip-flop SR2 is thus connected to the inputs for the address generators APl-APn, which are of the same type as the generators ADl-ADn. Each address generator is connected to the address inputs of a corresponding program memory PSl-PSn. The task of the generators is, as previously mentioned, to generate all addresses that may occur in connected program memory, controlled by the common system clock and then to designate each address in the memory. The word length in the program memories is that. same as in the data memories, i.e. 4 bits. Gate circuits GPl1-GPn4 of the same type as gate circuits GDl^-GDn^ are connected to the data inputs for the program memories. The output of the flip-flop SR2 is connected to the inverting input for all AND circuits GPl-^-GPn^A second input on each AND circuit is connected to a control bus CB which is common to the program memories and via which bus the computer CPU normally exchanges data with the memories PSl-PSn. The output of an OR circuit ORPl-ORPn is connected to the scree input of each program memory. An input for each OR circuit is fed from the computer XPU, which provides a write pulse at. normal operation. The other input for the OR circuits is connected to the output of the flip-flop SR2, from which write pulses are obtained during erasure. A register RPl-RPn of the same type as the registers RD1-RDn is connected to the data outputs of each of the memories PSl-PSn. The outputs from the registers are connected to corresponding inputs, for AND circuits OPl-OPn, whose outputs are inverting and connected to inputs for a further AND circuit 03.

The output of the circuit 03 is connected to the setting input of a third bistable flip-flop SR3 of the same type as the flip-flops SR1-SR2, and whose output is connected to a control lamp L. In this case, a counter C2 is also connected to the output of the flip-flop SR2, which is common to all program memories and of the same type as the counter Cl. When the last position in the program memory is designated, the counter C2 reads the selected word into respective registers RP1-RPn. AND circuits BPl-BPn are connected to the read inputs for the program memories to block reading of the memory during erasing. One of the inputs for each of the circuits BPl-BPn is inverting and is fed from the flip-flop's SR2 output. Under normal conditions, the computer CPU gives read pulses to the memories when connected to the second input for the circuits BPl-BPn. As mentioned, the counter C2 cancels the read block every time the last address in the memory is selected. In normal cases, a computer CPU works in a known manner against connected memories DSl-DSn or PSl-PSn. However, should a situation arise where the information in all memories must be deleted, this happens according to the process described below.

The operator activates a spring-back push button, a so-called "disaster button", at an operation point MO. Then a positive voltage pulse is sent to the setting input of the bistable flip-flop SRI, which is then set to ONE, i.e. emits a logic one signal at the output and remains in this position, unless a reset signal is fed to the flip-flop's reset input. The output signal from the flip-flop SRI activates the address generators ADl-ADn, which, controlled by signals from the common system clock CL, begin to generate all addresses that may occur in the connected data memories DSl-DSn. The address generators work in parallel, but each against its own data memory. All addresses in the data memories are designated by tu-r. The output signal from the flip-flop SRI also activates the inverting inputs for the AND circuits GD1^-GDn^. and the outputs from the mentioned AND circuits are assigned a logical ZERO signal. The ONE signal from the flip-flop SRI is fed to one of the inputs of each of the OR circuits ORl-ORn, the outputs of which then send write pulses to the write input W of respective data memories DSl-DSn. When a data memory receives a write pulse, the zeros from the AND circuit's GDl-^-GDn^ outputs are written into each memory location at the addresses designated by the address generator. In this way, designation and writing continues in each memory until the entire memory is filled with zeros, regardless of what may have been written there before. In order to obtain a confirming signal that the memories have been completely deleted, i.e. filled with zeros, and to start the deletion process for the program memories, information from the last address position in the respective data memory is read out to the registers RDl-RDn. As earlier . mentioned, the reading from the data memories is locked in all address positions except the last one. The counter Cl, which contains as many steps as the number of words in the data memory, is activated by. the signal from the flip-flop SRI and is switched forward step by step, controlled by the common system clock, one step for each selected address in the data memory. When the counter has reached the position corresponding to the last address position in the data memory, it outputs a signal that directly activates the read input R for all data memories DSl-DSn, so that the contents of the last address position for each data memory are fed to the respective register RDl -RDn. In the other address positions, the reading is blocked by the ETT signal from the flip-flop's SRI output, which signal is fed to the inverting inputs for the AND circuits Bl-Bn. The outputs from these circuits send a zero signal to the read input. for respective.data memory. At these addresses, no activation signal is sent from the counter Cl. The output signals from the registers RDl-RDn are fed to corresponding inputs for the AND circuits ODl-ODn. Since the outputs from said AND circuits are inverting, each circuit emits a logical ONE signal which is fed to a corresponding input for an AND circuit 02. Thus, the inputs of circuit 02 are activated in parallel, when the last address position of the respective data memory is read. The signal from the output of circuit 02 is fed to the flip-flop's SR2 input, which is then activated and sends a ONE signal to the output. This signal constitutes an activation signal for deletion in the program memories PSl-PSn. The process is exactly the same as discussed in connection with deletion in the data memories DS1-DSn. The signals from the flip-flop SR2 activate the address generators APl-APn, which, controlled by the system clock CL, generate all addresses that can occur in the associated program memories PSl-PSn. In turn, all addresses are designated. The signal from the flip-flop SR2 activates the inverting pulses from the AND circuits GPl^-GPn^ and further provides a write pulse to the program memory's write input W . by activating an input for each of the OR circuits'ORP1-ORPn. The logical zeros that appear on the data inputs for the memories during deletion are written into the addresses designated by the address generators, so that all program memories are also eventually filled with zeros. The erasure is then finished and the information in the last selected address position in each program memory is read to the respective registers RPl-RPn, when a read pulse is obtained from the counter C2, which is switched forward step by step synchronously with the address generators and is common to the memories. Blocking of the reading in the other memory positions is achieved by the fact that the output signal from the flip-flop SR2 activates the inverting inputs for the AND circuits BPl-BPn, where a zero signal is obtained on the read inputs R for the memories, as the counter C2 also sends a zero signal in these address positions. The signals from the registers RPl-RPn are fed to corresponding inputs; for the AND circuits OPl-OPn, whose inverting outputs send signals to corresponding outputs of an AND circuit 03. When all memories are erased and the inputs of the circuit 03 are consequently activated, this circuit sends an output signal to the third bistable flip-flop SR3, which is then set to ONE and sends an activation signal to the lamp L, which then lights up and shows that the entire deletion process has ended.

Under normal conditions where all flip-flops SR are set to zero, ie no erasure is in progress, the computer CPU, which is not shown in the drawing, controls the writing and reading of the memories. Writing is carried out by connecting to the OR circuits ORl-ORn respectively. ORPl-ORPn. Reading is carried out by connecting the computer to the AND circuits Bl-Bn respectively. BPl-BPn. When a zero signal is sent from the outputs of the flip-flops SRI and SR2 to the inverting inputs of the AND circuits GDl-^-GDn^ respectively. GPl-^-GPn^, the feeding of information to the memories from data bus DB and control bus CB is completely controlled by the computer CPU.

Further advantages of the device according to the invention are: As several physical memories are used, it would take a long time to delete all information, if the computer itself were to perform this with normal access possibilities, one word at a time. By parallel deletion in the memories, a significant time saving is achieved.

With the device according to the invention, the computer is relieved of capacity-demanding work.

Short access time when divided into several memories, which also means modularity in case of possible expansion.

Claims (1)

Device for automatic destruction when deleting the information content in data memories and program memories in database installations without destroying the equipment, characterized in that an operating device (MO) in an activated state sends a control signal to a first set of parallel working address generators (AD1-ADn) for successive generation and selection of all addresses in a memory (DSl-DSn), which are separately associated with each of. the generators, and which memory is part of a first memory set, where said control signal is also connected to a second set of parallel-working generators (APl-APn) for successive generation and selection of all addresses in a memory (PSl-PSn) which is separately connected each of the address generators, which memory is part of a second memory set, and that gate circuits (GDl^-GDn^) are connected to the data inputs for each memory unit in the first memory set, via which circuits binary digits of the same logic level are entered in a first step in the successively selected addresses for said memories in said first memory set, and that gate circuits (GPl-^-GPn^) are connected to the data inputs for each memory unit in said second memory set, via which circuits binary digits of the same logic level in a second stage are written into the successively selected addresses for said memories in said second memory set.