CN1021089C

CN1021089C - Protecting mechanism for stored information

Info

Publication number: CN1021089C
Application number: CN 90101742
Authority: CN
Inventors: 杨筑平; 李利安
Original assignee: Individual
Current assignee: Individual
Priority date: 1990-04-05
Filing date: 1990-04-05
Publication date: 1993-06-02
Anticipated expiration: 2005-04-05
Also published as: CN1046620A

Abstract

The present invention relates to a stored information protecting mechanism which belongs to the field of computer system and information security. The present invention provides an effective method for a computer system in an open bus structure, and the effective method has the advantages of independence of a system main CPU and system software, no modification of system hardware and capability of preventing the illegal access to stored information. The present invention is characterized in that the external information of the mechanism is reserved and registered on the basis of a first-level protecting mechanism of circuit signals, and internal online interception, internal real-time detection, internal rapid verification, advance lockout and conversion operation among the states are carried out. The method of the present invention has the advantages of simplicity, safety, reliability and easy realization and has active effects on the resistance to the intrusion of computer viruses and on the suppression of computer crimes.

Description

Protecting mechanism for stored information

The present invention relates to a kind of protecting mechanism for stored information, belong to department of computer science's information security field of unifying.

In the computer system of bus-type architecture especially personal computer system, because the opening of system bus, memory device seems that very fragile-canned data (program and data) is easy to be stolen or suffers consciously or unconsciously destruction.In order to address this problem technically, people have taked thousand and one way, be divided into two classes substantially: the one, to information encryption (as the DES Standard Encryption algorithm of the U.S.), the 2nd, restriction is to the access rights (as password in the computer lan system and access right function) of information.Obviously, encrypt only relatively to tackle and steals (" reading " operation), unablely tackle destructions (" writing " operates), therefore, the limiting access authority is the way of essence.Yet, be the key point of problem but implement to limit how effectively, reliably.Known way (as the WATCHDOG software of Fisher Innis company, and the STOP LOCKIIR hardware of SDI company) be check on different levels-shell, kernel or the basic I/O system-based in operating system and restriction to the visit of canned data.But the defective of these ways is, they mainly rely on system's host CPU the corresponding software of operation or program is finished; And in fact as long as use special Software tool, or the operating system of the even not same copy of different editions, the restriction that just might walk around them directly conducts interviews to canned data.Therefore, such method also is not very reliable.Up to now, protection mechanism that Shang Weiyou is such or method, it is independent of system's host CPU and operating system, can either prevent the unauthorized access to canned data reliably, does not hinder the Lawful access to canned data again.

Purpose of the present invention; be that computer system for the bus-type architecture provides a kind of protecting mechanism for stored information; it is a kind of technical method; it is independent of system's host CPU and comprises the system software of operating system; and need not to change system hardware; just can prevent unauthorized access effectively, reliably, not influence Lawful access simultaneously again canned data to canned data.

Basic thought of the present invention is additional protection mechanism hardware in the original system hardware environment, intercepts unauthorized access to canned data at the bottom of system as much as possible.On function logic, protection mechanism (3) placed on the read/write servo control mechanism (2) and under read/write control interface parts (4).So user (6) handles processor (5) through read/write control interface parts (4), go to drive the visit of read/write servo control mechanism (2) to the physical medium (1) that is loaded with canned data, just must pass through the filtration of protection mechanism (3).Protection mechanism (3) is transparent for Lawful access, and can not pass through for unauthorized access.

Functional characteristic of the present invention is embodied in outside and inner two aspects of protection mechanism.

The applications characteristic of protection mechanism mainly is that the information of required protection is done preregistration.Based on concrete computer system, there are two class users in mechanism: an initial power user and some domestic consumers of being authorized generation by the power user.All users of mechanism communicate by letter with mechanism by an external utility that operates on system's host CPU.At first to check password; can make following operation then: the information (file/sector/bunch/piece) that change password, registration will be protected, the summary that shows protected information, the access rights (system, implicit, read-only, read/write) of appointment/protected information of modification, and the protection of revocation information.Mechanism occupies some reserve sectors or piece on storage medium, perhaps adopt metal-oxide-semiconductor memory, in order to putting down in writing whole passwords, preregistration, and necessary system information and status information.These reserve sectors or piece are subjected to the protection of mechanism automatically, and the metal-oxide-semiconductor memory that is adopted also can only be visited by mechanism oneself.

The built-in system characteristic of protection mechanism comprises and onlinely intercepts, detects in real time, examines fast and block in advance.The in-house course of work can be described by state transition graph.Mechanism is in the state of intercepting all the time by address unit (2); And if only if when there is the visit of pair memory device in the discovery system from address bus, just enters detected state.Mechanism according to the position and scope (cylinder, head, sector, the piece) set of data of the storage medium that is about to accessing storage device that intercepts from data bus, judges whether current accessed relates to the information of registered protection by data component (1); If the state of intercepting is then returned in irrelevant visit, if relevant visit then enters the state of examining.Mechanism is by control assembly (3) and data component (1), and according to the accessing operation of knowing from control bus and data bus (read, write, format etc.), whether the access rights of the information of the registered protection of reference verify Lawful access; Be the state of intercepting that then returns, otherwise enter blockage.Mechanism is forced rapidly to be blocked through system bus by control assembly (3) at unauthorized access, makes its inefficacy; Show error message simultaneously, the warning of sounding, and write down the unauthorized access incident automatically.Blockade finishes, and returns the state of intercepting.

Feasibility of the present invention is based upon on the basis of bus-structured opening.That is protection mechanism can be connected into and the using system bus equally coequally with other equipment or parts on the bus.Simultaneously, the running of protection mechanism and system's host CPU walk abreast, and are independent of the latter.The lock-out facility of protection mechanism, be to the interference of circuit signal on sequential of read/write store equipment with deprive.

The present invention compared with prior art has obvious advantage: the one, and method letter refining, clear thinking, system is complete; Two are based on the protection mechanism of circuit signal one-level, more safe and reliable; The 3rd, be independent of concrete computer system, be convenient to exploitation and realize.Enforcement of the present invention and application for resisting computing machine " virus " invasion and attack harm and suppressing computer crime, provide a kind of strong technological means and will produce positive effect.For the computer system of open bus architecture especially personal computer system, the present invention and realize that product has general practical value.

Fig. 1 expresses the function logic relation of the present invention in computer system.Among the figure, 1 is physical medium and canned data, and 2 is the read/write servo control mechanism, and 3 is protection mechanism, and 4 is read/write control interface parts, and 5 is processor, and 6 is the user.

Fig. 2 is a protection mechanism internal work process status transition diagram.Wherein, " intercept " be initial state be again final state.

Fig. 3 shows that the inside of protection mechanism constitutes.Among the figure, 1 is data component, and 2 is address unit, and 3 is control assembly, and 4 is CPU, and 5 is random access memory, and 6 is ROM (read-only memory), and 7 is clock generator, and 8 is metal-oxide-semiconductor memory, and 9 is battery.Wherein, 8 and 9 can be sky.

Realize a kind of preferred plan of the present invention below in conjunction with figure three explanations.

Protection mechanism is implemented with the bus connector form as an entity.Wherein,

1) address unit (2) comprises an address buffer, an address register and one and door.In address that impact damper receives and the register by CPU(4) address of the memory device that presets, through with door mutually " with ", its result is by positive logic, as the condition of " detection " state of activation and turn-on data parts (1) and control assembly (3).

2) data component (1) comprises a bi-directional data latch.

3) control assembly (3) is corresponding compatible with the system control bus.

4) CPU(4) adopt INTELL 8088.

5) random access memory (5) adopts static RAM (SRAM), to save refresh circuit and to improve access speed.

6) ROM (read-only memory) (6) adopts a slice 27256.

7) clock generator (7) is provided for oneself, so that mechanism and system's host CPU are independent and parallel.

8) MOS circuit (8) adopts the cmos device of low-power consumption.

9) battery (9) adopts the 6V rechargeable battery, in order to keep the information of depositing among the CMOS.Charge power supply is taken from motherboard via system bus.

Claims

1, a kind of canned data guard method; it is characterized in that; in computer system, be connected into a hardware; protected automatically in outside preregistration information to be protected and register content; pass through system bus in inside: the online address of intercepting; detect memory location and the scope of institute's visit information on storage medium in real time, examine access rights fast, block unauthorized access in advance.

2, a kind of protecting mechanism for stored information; comprise address unit, data component, control assembly and program curing; form connector; it is characterized in that also comprising the monitoring bus circuit; link computer system by bus expansion slot; can be by detecting the visit of host CPU on the system bus to memory device, and access process is postponed or interrupt.