DE1940296B2 - SETUP IN ELECTRONIC DATA PROCESSING MACHINES TO PROTECT THE CONTROL PROGRAM - Google Patents

Description

3. Device according to claim 2, characterized in that.

indicates that the AND circuit (11:50 is assumed that a state provisionally Ψ i g. 2) has a further input that can be generated by deleting the control memory completely getin only the signal generated by the maintenance staff, that is, that even such microprogram parts Ci) have been deleted via the inverter (10) the generation of the (loader), which prevents the loading of the memory lock signal (£). erprograms themselves are required, then there is

4. Device according to claim 2 and / or 3. 55 to avoid difficulties essentially characterized in that the bistable switch has two possibilities, one of which is better (9; Fig. 2) stands up as a locking circuit, the entire charger as a circuit arrangement is building. to train. The other solution only sees a circuit arrangement for reading in the first hole

60 card on which the first part of the loader is located. The machine then branches to the read

NEN place and carries out the further reading of the loader with the help of the microprogram read in up to this point the end.

65 A realization of the loader for the control pro-

The invention relates to a device in electrogram as a circuit arrangement is particularly different niche data processing machines for the protection of small data processing machines from the following Loading program and the reasons for the loading process:

1. The cost of the necessary circuit arrangement ^loading program with a device & emaß d ^er . ^{In order to make} the system more expensive, we protect it against unauthorized access

2. In the event of changes or extensions to the control program, FIG. 2 the block diagram of the protective device program is also a change to the circuit 5 according to an exemplary embodiment. Ithid processing arrangement necessary, which particularly in Fig. 1 shows essentially a ^B1 ° cKSChaitDii the use of integrated technology very around the main memory and its immediate read ", laborious, time-consuming and expensive and write circuits that are in the Zentraleinneii

a small electronic data processing device

For these reasons, it is advisable to have a built-in implementation. The main memory 2 consists in mn "of the loader for the control program in the form of a known manner from a microprogram only to the maintenance staff, in which a test algorithm nal accessible control part 1, in which aem can be included, with the help of which the loading of the control program Machine oeimaeu control program is checked every time it is loaded, as it is, as already mentioned, for the correct operation of the machine and whether it is read in error-free operation of the data processing machine Data processing has already been thought of, this test workun es machine approved control program in algorithm, which can ultimately be loaded to check the loaded machine, certain control programs must carry out as circuit arrangements to protect this control program but it is only sensible to be taken 20. The remaining part of the main spta full if the loader itself is protected against changes, the so-called customer memory, is protected from Sien, since a change could, for example, put the test not protected against customer access, and could inevitably render it inoperative. Another is the problem-oriented program, a disadvantage of which is that the customer wishes to execute this test algorithm as a circuit. Since the main memory is to be developed, it means that in the case of (MS) 2 there is generally a core memory, desired changes to the control program and this information would not have to be changed without further destruction, which means that the codes are read out can, there is a SpeicnerzyKiu * stender system would increase. from two partial cycles, the read cycle and the It is therefore the object of the invention to provide a one-write cycle. In the read cycle, the ^{direction in the 5} P ^eicn "direction will be indicated, dfe the loading and control process 30 address register (SAR) 3 located address for the orimirT of an electronic data processing addressing of the desired memory location and protects and detects unwanted changes at this point In the storage data register (SDR) 5 ^a " ^s S ^e !" ^en _n For a device in electronic data processing machines during the write cycle, regeneration takes place to protect the load pro-35 This information in the ^ur ; P ™ ⁿ | ^llcnen ^ ^{e] CnQT} π, amms' (loader) and the control program required by the loading prronram via the locking switch (INH) A. can about the spemuuu or unwanted change, the invention consists of ter4 not only the oeiinu dmn in the memory data register that a device for the transmission of the borrowed information can be regenerated, s . onaera e, ■ m subroutine of the second 40 may for reading a example of ^a ™ ^NME f ""'T,' s of the I adenfund examining the loader and control and logic unit (ALU) S present iniorrnanrorramms ^on machines belonging existing tion in a by the memory address register j first Ύή \ of the loader in the memory location defined against customer / access during the read cycle gc cc-protected control part of the main memory that is also stored. This last-genanje UWenpj.a ein, device for transferring the data from an Un- 45 can, however, be blocked for the transfer by a special control automatioirc temroaramm for loading functions. This is in F1 g. 1 sedlenwist of the information from the input area to the command area by this control signal over ™ f £ the memory and for error detection existing verier 7 a gate circuit 6 ^ uert, each one: in the second part of the loader in the ar itself unprotected mation transmission from the arithmetic unu s part of the main memory and that finally a 50-see unit 8 is provided for the locking switch 4 vernmaer device, which is inherently un- As already mentioned in the introduction, _is ^ MiIiV.inui.g, _fr ^ η _η1 ., _η ,, ₀ , οΛρ Tiinocmaschinen important, aai3

Device is provided that the un- se As mentioned in the introduction, he _ protected portion of main memory during the laser for small data processing machines ™ ^lc ™ & ^u Ts loader and d "control program to the charger for charging the STEU ^ rogrammes change protects. Developments of the invention züglich its cost ^is not aufwenig ^<üa ^ _ are presented in the dependent claims. 55 not insignificant to the. ^Οε5 ^ ° ^5ΐ !. "^ _Ίο ΐ _εη The one who achieves through the subject matter of the invention is involved. The loader, the real advantage concerns essentially the cost reduction as a small ^Mlkro P; ^o f ^am ™ . ^mi / ^ eilhafter way of financing facility to protect the Ladepro- constructions is carried out, is split into beneficial natter oriented program and the control program against unwanted in two parts.

decoration g

program and the control program against

desired change, especially with little 60

nndung In hand of the drawings near b « _S ch ™ - ^ 'ΓεΑΑ Ka ^ fÄS Kdepro-

protected, d. H. the customer accessible part of the main memory 2 is read and in essentially consists of routines, which load functions, such as transferring the Data and instructions from the input to the command area, including memory shifts, Print out a loading list, perform error detection, etc.

The first part of the loader, as well as the entire control program after the load operation has been carried out, is located in the principally protected control part 1 of the main memory. The second part against it is located in the initially unprotected part of the main memory, the so-called customer memory. However, it must also be possible to protect this part while the loading operation is being carried out, so that a change in the approved control program by the user in both the intended, as well as inadvertently impossible. The maintenance staff must be able to make this change however, it must be given in each case and it must apply to both the control part 1 of the main memory 2 as well as the customer memory while the loading operation is being carried out relate.

The protection of the second part of the loader must primarily relate to the fact that

1. Manual changes to the program in the memory using logic circuits (see Fig. 2) be suppressed and

2. A premature termination of the program loading due to a system reset for security reasons must be allowed, it is allowed, but no execution of the loaded program takes place as long as the load operation has not been run through completely.

As in connection with FIG. 2 will be explained in detail by means of a bistable switch, which is set for loading the program when the start button is pressed and is only reset by an instruction after the full load is complete. Be it in this context reminded once again that these two locking functions of the Maintenance personnel must be able to be picked up.

In known machines, therefore, a security key is only available on the control panel operable switch provided which can switch the machine from the user mode to the maintenance mode. When the machine is in the maintenance mode, the program loading is started by a Program load switch is operated. This becomes the "first card in the control section 1 of the main memory 2 read in. It is possible to use the address switch on the console to locate the location in the Define memory into which the first card is read.

On the other hand, if the machine is in user mode, the reading will be the first Card forced to a fixed, previously defined address. ~

At the same time as the start button is pressed, the control signal D is also generated which corresponds to the one shown in FIG. 2 illustrated bistable switch 9 switches to its "1" position. When this bistable switch is set the machine can only read cards and process their contents. The other functions of the Input / output devices, such as printing, punching, reading or writing from disk storage and the like are temporarily blocked. However, these functions can also be used in the maintenance mode executed and used.

ίο While the control program is being loaded, you can all processing functions of the central unit of the electronic data processing machine the entire core memory can be used. The start of processing during this However, the operating mode is forcibly entered into the control section of the main memory after a card has been read relocated.

However, the system can only exit the charging mode if the aforementioned bistable Switch is reset. As already mentioned, this is done by means of a microprogram routine carried out, which is located in the control section of the main memory. When the bistable switch is reset again, the machine can leave the loading mode and go to the user mode, d. H. pass to the processing plant.

As part of the loading program, the following program parts are stored in the control memory:

The first part of the loader for loading the control program,

the test algorithm and test data to ensure that a correct loader has been read became,

Another checking algorithm to ensure that the correct control program has been read was, and

the instruction, with the help of which the bistable switch from the loading mode to the user mode is switched.

Since the control part of the main memory is not accessible to the customer, the following functions to be carried out:

It is first made sure that the loader was loaded correctly and that it is impossible is to change him;

it is also ensured that the correct control program has been loaded and that it is impossible to change this too, and
the bistable switch is switched over when the correct control program has been loaded.

As already mentioned, the control part 1 of the main memory 2 contains all the information that is necessary is to check the correctness of the loader. As the test data for the control program part of the loader the control section does not allow any changes to the control program.

F i g. 2 now shows a circuit arrangement with the aid of which the charging operation is carried out used customer memory is locked for the user during the load operation. As already Mentioned several times, however, this circuit must be accessible to the maintenance personnel Enable storage. By pressing the start button

For the start of the loading operation, the signal D is generated, which controls the bistable switch 9 in its "1" position. The "1" output signal of this switch is transmitted to an input of the AND gate H. Only if the operating mode switch is not set to maintenance mode does it deliver an »O« signal, which is transmitted to the input of the inverter IO. The output signal of this inverter is a binary “1”, which is also transmitted to the AND circuit 11. If the user intentionally or inadvertently manipulates certain functions which are present in most data processing machines and which are intended to enable information to be written into the main memory, then a signal B is generated, which now opens the AND circuit 11, which then has a » 1 «- output signal generated. This signal goes to the inverter 7 in FIG. 1, which converts this signal into a binary "0". As a result, the memory change function carried out, for example, via the arithmetic and logic circuit 8 is blocked, since the AND circuit 6, via which the data path runs, is blocked

When the operating mode switch is in the maintenance mode position, it generates the signal that corresponds to a binary "1". The output of the inverter 10 in FIG. 2 converts this signal at its output into a binary "0" so that the AND circuit 11 is blocked. The output signal E then corresponds to a binary "0". This means that when the data processing machine is in maintenance mode, the maintenance personnel can also make changes to the memory during the loading operation, since the AND circuit 6 in FIG.

Short Summary

The loader, implemented as a microprogram, for loading the control program into the control part of the main memory of an electronic data processing machine consists of 2 parts, the first part of which contains routines for drawing in the cards of the second part, as well as routines for checking the loader to ensure that the correct loader is in the system is loading. The second part is temporarily located in the customer's memory and contains the essential loading functions, such as transferring data and instructions from the input to the command area.
While the data in the control section of the main memory

The sensitive first part of the loader is generally protected in that it is in one by the user inaccessible part of the memory, the second part, which is in the normally accessible part of the memory, must be Customer part is to be protected. For this purpose, logic circuits are used that essentially consist of a bistable switch that is set at the start of the charging routine and prevents that other than the loading data and instructions are read into the machine. At the end

the loading operation is reset with the help of a special microinstruction of this switch, so that the machine is now released for the user program.

1 sheet of drawings

Claims (2)

gram eLizreadenden control program against incorrect patent claims: required or undesired change, whereby the control program for the interpretation of customer pro- 1. Establishment in electronic data processing is used. Processing machines to protect the loading program 5 Control programs are to be read in by the manufacturer of the electrogram (loader) and the program developed by the loading program data processing system against programs (generally microprograms) that contain the incorrect or undesired changes, including the actual customer program that is contained in The system in the case of the control program is used to interpret the languages of the respective machine written down customer programs, thereby ίο is able to interpret them. These control programs are typically characterized by a device for depending on the pen and can also be differently checking the loader and control program for measurements according to the transmission of the from a subroutine for equipping the same machine with additional reading-in of the second part of the loader and for directions and peripheral units . A change in these control programs, however, is undesirable in the first part of the first part of the following Grimden, which is part of the machine
Loaders in the protected against customer access Control part (1: Fig. 1) of the main memory (2) that 1. Certain control command sequences take on the learner a device for the transmission of the permissible duty cycle of machine elements ♦ in a subprogram for loading functions for the sake of consideration, the outsiders do not the transfer of the information from the input 20 is known. turn command area of the memory and for incorrect 2. Rei improper change of the control pro- The existing second part of the program can determine the correctness of the results ders in the inherently unprotected part of the and the speed specifications of the manufac- Main memory and that ultimately a fitter nkht will be guaranteed, • ung (F i g. 2) is provided that the per se un- 25 Protected part of the memory during loading This problem is of relatively minor importance. ens of the loader and the control program against interpretation. when the control program is in perma changes protects. nent or semi-permanent storage is because a 2. Facility to protect what is in itself unchangeable. Change is very difficult here anyway. This situation is different with such electronic loading of the loader and control program according to data processing machines in which claim 1, characterized in that a two-way control program in a switch (9; Fig . 2) is provided, the usual part of the main memory is located. Here by a start signal (D) at the beginning of the I.adeope, erroneous changes in the control program are controlled in its binary "1" position, among other things, because it is possible that this "1" output signal becomes a Generally designed as a core memory main AND circuit (11) is transmitted, the memory of which is not inherently already non-destructive input signal (β) when an In can be read out. The information read out from a specific lormation change in the memory must therefore be stored, the output signal (E) of this 40 being temporarily stored in a register and the new writing of new write cycles from this register in the ui memory information (F i g. 1). however, the original memory location is not written back again. Memory regeneration locks and that the bista- are. During this process, it is possible that at the end of the loading operation, a signal (C) sent back to the memory by a disturbance signal on a memory line causes incorrect information to be sent back to the memory (C). It must therefore be possible in such machines that information changes are now given in the unprotected way, the control program can be carried out as part of the main memory. to be able to load into the control part of the main memory