SU1513458A1 - Memory protection device - Google Patents

Abstract

The invention relates to computing and can be used to create information security systems stored in computer memory and subscriber stations at shared-use computing centers. The purpose of the invention is to increase the reliability of the device. It is achieved by detecting residual information at each redistribution of pages of RAM between users' programs and providing the ability to quickly change the structure of permissions for access to RAM when assigning tasks. The device contains a register of 1 protection keys, a register of 2 addresses, a register of 3 memory keys, a priority recording block 4, a protection key memory block 5, a program rank analysis block 6, a call type analysis block 7, a priority memory block 8, a control block 9 , an unauthorized access signal generator 10 and a page type analysis block 11. 3 il.

Description

The invention relates to computing technology and can be used to create information systems stored in computer memory and subscriber stations at shared-use computing centers.

The purpose of the invention is to increase the reliability of the device.

FIG. 1 shows the ycTpoiicTBa structure diagram for memory protection; in fig. 2 is a block diagram of a priority recording unit; FIG. 3 is a block diagram of the page type analysis block.

The memory protection device contains (FIG. 1) a security key register 1, an address register 2, a memory key register 3, a priority recording block 4, a security key memory block 5.

a program rank analysis unit 6, a reference type analysis unit 7, a priority memory block 8, a control unit 9, an unauthorized access signal generator 10 and a page type analysis unit 11.

Unit 4 of the priority recording (FIG. 2) contains a counter 12, a trigger 13, a delay element 14, an element NOT 15, an element 16 and 17.

The page type analysis block 11 contains (FIG. 3) the element OR 18, the element AND 19 and the trigger 20.

The memory device operates in the following modes for writing keys to a security key storage; write access to the memory block, these priorities, and in the main mode, which controls access

oo

"Lib SL

CX)

(grams of users to pages of | mi ty.

I The introduction of the access authority recording mode is explained by the fact that in the unified system of computers there are modes of task redistribution and task redistribution. In the task redistribution mode, the memory access authority structure can be changed.

In accordance with the program of task redistribution and under the action of signals arriving at the inputs, the resolution of the address formation and the access deactivation in block 4 are formed from the address, the priority memory block 8 is filled with one-bit access code. Code,

is equal

l

means access to

Memory is allowed, O is not allowed. This allows for the redistribution of tasks to quickly change the structure of access to RAM.

In the mode of writing memory keys to the Security key memory block 5, this 5 device allows detecting and destroying the contents of the pages with the remnants of information.

The memory keys are written in the block 5 of the security key locations when the pages are distributed among users. At the same time, the information left on the page from the old one, the user, constitutes a section of the in- formation closed to another user. Detection and destruction of information remnants is an important function of the information security system. Nowadays, this operation is performed using the programffl method. The proposed device allows one to perform this one-instrumental method, which significantly speeds up its flow: In the mode of writing the memory keys to the block 5 of the security key, the device works as follows

: (FIG. 1),

: The address of memory page is entered into register 2 addresses | In register 3 (memory keys, the key of the memory page is stored, which is assigned to the memory page. We will call it the new memory key. The old | memory key is stored in block 5 of the protection key. Page key Part-I consists of three groups of bits; the first bit is a sign of access to the memory: 1 — read and write is allowed, O — read only; three bits of the page importance level code; last four bits — the page key itself memory. The address of the memory page consists of two groups of bits; the first bit e - sign of the type of user program access to the memory page, - the remaining 7 bits are the actual memory page address.The actual address of the memory page of the output of the register 2 address goes to the address input of the protection key memory block 5, in which the old key is fetched memory protection. The old memory protection key is issued by elements: the code of the importance level comes from the second output of the protection key memory block 5 to the input of the program rank analysis block 6, the actual key of the memory page from the third output of the key memory block 5 s - a fourth input of the memory unit 8 priorities. The code of importance from the third output of the register 3 memory keys and the actual key of the memory page from the first output of the register 3 memory keys arrive at the input of the program rank analysis block 6 and the input of the priority memory block 8, respectively. A signal about the presence of the rest of the information is issued by block 11 in two cases: if the new user of the page does not have the right to access the old user of this page for access rights and if the importance level of the new page is less than the importance level of the old page.

Thus, in the block 8 of the priority memory, the access of the new user of the page to the memory of the old user is checked. The actual key of the memory of the new user and the actual key of the memory of the old user are fed to the inputs of block 8 of the memory of priorities. If the contents of this cell, taken from the output of block 8 of the memory of priorities, are equal to the logical O signal, access to the memory is allowed, if 1 is denied.

The code of the levels of importance of the new key comes from the third output of the register of 3 memory keys to the input of the program analysis block 6. The code of the severity level of the second key is fed from the third output of the memory block 5 to the protection key to the input of the program rank analysis block 6. In block 6, the codes of the levels of importance of the new and old keys are compared. If the importance level of the old user is higher than the new one, a logical 1 is generated at the second output of the program rank analysis block 6, which signals the presence of the rest of the information. In access control mode, this signal is perceived as a security violation. If the importance level of the new user is old or higher, the signal from the second output of block 6 is not appreciated.

At the output of block 8 and the second output of block 6, if there is a balance of information, signals of logical 1 are formed. These signals are fed to the inputs of block 11. The signal for detecting the rest of information from the output of block 11 is fed to the input of address 2 register and can be displayed on the display panel to the computer operator ( not shown). This signal from the third output of register 2 addresses to the output of the device receives the address of the memory page, the contents of which should be deleted. After that, from the second output of the register of 3 memory keys, a new key of the memory page is allocated to the input of the program rank analysis block 6 and through it to the input of the protection key memory block 5. In block 5, a new memory page key is recorded. After the new keys are written to all cells, the mode of reallocating the keys of the RAM pages ends

The main mode of operation of the memory protection device is to control the access of the user program to the operative pages with the formation of a signal of the protection violation at the output of the imager 10, which occurs in cases when the user program accesses the memory page by authority m access; if the user accesses the page of memory for recording information, and he is only allowed to read it; if the user is accessing the information but the importance level of the user program is less than the importance level of the RAM page.

If the user's program key contains an even number of units, then the device generates a failure signal coming from the output of control unit 9.

five

0

0

five

Q

In the main mode, the device operates similarly to the known device.

The address of the operating memory page is recorded in the address register 2 and, from the second output of the register 2, the actual address of the memory page is fed to the input of the memory block 5 of the protective packet,

Q p which fetches the key of the memory star, as discussed earlier. In this connection, the first output of the security key block 5 generates a signal of the valid type of access, at its second output the code of the page importance level, at its third output - memory key.

The type of access signal from the first output of the protection key storage unit 5 is fed to the input of the access type analysis unit 7. The other input of block 7 receives a sign of the type of circulation that is currently being addressed.

5 user. The remaining inputs of block 7 receive the user program key and the memory page key, respectively, where they are compared. The signal at the output of block 7 appears in the event that the user is turning to record information, and he is only allowed to read, provided that the user keys and memory pages do not match. The signal from the output of block 7 is fed to the input of the imager 10. The key of the user program is recorded in the register 1 of the protection keys and from its first output is fed to the block 9 of the control. A fault signal at the output of block 9 is formulated in the case of a clear number of units in the security key.

At the same time, the permissions of the user program to the memory page are checked by severity levels. The code of the level of importance of the memory page from the second output of the block 5 of the memory of the protection keys is fed to the input of block 6, to another input of which the code of the level of importance of the user program is received.

When accessing the read memory, block 6 operates similarly to the key redistribution mode. When accessing the memory by writing, it is necessary to compare the level of importance of the memory page with the level of importance of the user program, if the level of importance of the user program is higher.

0

five

five

| memory page level is necessary | increase.

; If the severity level of the memory page is lower than the severity level of the recorded information, the severity level code of the user program from the first output of block 6 is recorded in the corresponding cells of the security key memory block 5.

If the severity level of the memory page is greater than the severity level of the user program, the second output of block 6 generates a protection violation signal input to the driver 10. The user program key posts from the second output of the protection key register 1 to the input of the 8th priority block. The actual key of the memory page is sent from the third output of block 5 to another input of block 8. In block 8, one-bit memory permissions of access rights is selected, as shown in the recording mode, prioritize

ITOB. A signal 1 is generated at the output of block 8 if the memory access is prohibited by access authority. The signal from the output of block 8 is fed to the input of the generator 10. The violation signals from blocks 8, 6 and 7 are received to the inputs of the generator 10, from the output of which the signal of protection violation arrives at the output of the device to interrupt the execution of the user program and signal to the operator COMPUTER. This is where the basic mode of operation of the devices ends.

Claims (1)

1 formula of the invention i A device for memory protection, containing a register of protection keys, an address register, a register of memory keys, a memory block of protection keys, a priority memory block, a control block, a forwarder of unauthorized access signals, a rank analysis block programs and a unit for analyzing types of access, the information input of the security key register being the input of the User’s program key, the information register address input being the address of the device page address, the memory key information input of the register The key device of the page, control inputs of the register keys za-: shields address register and key register memory are respectively 0 0 five five thirty 40 45 first, second and third inputs Resolution of the input informatschiki device. The synchronization inputs of the security key register, the address register and the memory key register are combined and are the device sync input, the first output of the security key register is connected to the control unit input, the output of which is the device error output, the second output of the security key register is connected to the program key input the user of the block of analysis of types of access and with the same input of the memory block of priorities, the third output of the register of protection keys is connected to the input. Level of importance Pages of the block of analysis of program ranks, The first output of the address register is connected to the input Sign of the type of inversion of the program rank analysis block and the same input of the block of analysis of access types, the second output of the address register is connected to the address input of the security key storage block whose information input is connected to the first output of the program rank analysis block, the first the output of the register of memory keys is connected to the input. The key of the page of the rank analysis block of the program, the first and second outputs of the memory block of the protection keys are connected respectively to the entrance. access type and input level Severity level of the rank analysis block np orpaMMbij third output of security key storage unit is connected to the input of the key page of the priority memory block and the same name input of the access type analysis block, outputs of the priority memory block, program rank analysis block and analysis block types of access are connected to the corresponding information inputs of the authorization signal generator, the output of which is the output of the unauthorized access of the device, control and installation the unauthorized call shaper inputs are respectively the fourth input. Resolution of information and the first installation input of the device, characterized in that, in order to increase the reliability of the device, a page type analysis block and a priority recording block are entered into it, and the first and second information The inputs of the page type analysis block are connected to the output of the priority memory block and the program rank analysis block, the control and installation inputs of the page type analysis block are respectively the fifth input. The resolution of the information and the second device setup input, the output of the page type analysis block are connected. with the address enable entry of the address register and output; Existence of a page with information to be erased by the device; the third output of the address register output is the address of countries Devices with the information to be erased, the device, the second and third outputs of the key register zasch1 with 45810 You are connected respectively to the first address input of the priority memory and the second input. The level of importance of the page of the program analysis rank block, the inputs Enable the formation of the address and the access permit of the priority recording block are respectively the device inputs of the same name, the installation input to the initial state of the priority recording block is the third installation input of the device, the synchronization input of the priority recording unit is connected to the device synchronization input, the second address input and the Authorization input the access of which is connected to the outputs of the priority recording unit. 0 srig.1 18 FIG. g nineteen 20