DE1940296C3 - Device in electronic data processing machines for protecting the control program - Google Patents

Description

60

The invention relates to a device in electronic data processing machines for protection of the loading program and the control program to be read in by the loading program against erroneous or unwanted change, the control program to the interpretation of customer programs serves.

Control programs are programs developed by the manufacturer of the electronic data processing system (generally microprograms) which are the actual customer program that is in the system language is written down on the respective machine! These control programs are type-dependent and can also be equipped with additional equipment according to the equipment of the same machine and peripheral units may be different. However, there is a change to these tax programs undesirable for the following reasons:

1. Certain control command sequences affect the permissible duty cycle of machine elements Consideration that is unknown to outsiders.

2. In the event of improper changes to the control program, the correctness of the results can be compromised and the manufacturer's speed specifications cannot be guaranteed.

This problem is of relatively minor importance, if the control program is in permanent or semi-permanent storage, there is a Change here is very difficult anyway.

This situation is different with such electronic data processing machines in which the control program is located in a part of the main memory that is not accessible to the customer. here Incorrect changes to the control program are also possible because of the Main memories generally designed as core memories are not inherently non-destructive can be read out. The information read out from a specific memory location must therefore buffered in a register and in a new write cycle from this register to the original one Memory location can be written back. In this process it is possible that incorrect information is written back to the memory due to an interference signal on a memory line will. It must therefore be possible with such machines to rewrite the control program to be able to load into the control part of the main memory.

It is assumed that there may be a state in which the control store is completely erased is, d. This means that even those microprogram parts (loaders) that were necessary for loading the control program were deleted themselves are required, then there are essentially to avoid difficulties two possibilities, one of which is the whole charger as a circuit arrangement to train. The other solution only sees a circuit arrangement for reading in the first punch card, on which the first part of the loader is located. The machine then branches to the one that has been read And uses the microprogram that has been read in to carry out the further reading of the loader out.

A realization of the loader for the control program as a circuit arrangement is particularly different in the case of small data processing machines for the following reasons:

1. The cost of the necessary circuit arrangement charging pragramni with a facility

tion make the system more expensive than unauthorized AUgrm

> Changes or extensions to the control "f i g. 2 the block diagram of the protective device

The program is also a change in the standard 5 according to an exemplary embodiment. _clam ltbild

necessary, which especially in Fig. 1 shows essentially a »·? _Read .

the use of integrated technology very environmentally main memory and semer ^{u "mi"} _{t ldnheit}

constant, time-consuming ^ expensive is, ^! ei ^ Ä ^

For these reasons, it is advisable to have a built-in implementation. Der ^Hau P ^ts P ^elC ^ _rtlin ^e _B ^S _{s!; ers0} _

tion of the loader for the Steuerprosramm in the form of a known manner from only the «JSK ^

a microprogram, in which a test algorithm nal accessible control part 1, in which mc

can be included, with the help of which the loading of the control program of the ^measure ~ ""' _mU :

Control program is checked each time it is loaded, as it is, as already mentioned for derι oro M

what is approved for the machine and whether it is defective

is read in empty. is that only for the benefit of this ^^ erar ^

It has already been thought of using Meuerprogran approved for this testing machine

oorilhmus, who can ultimately check the loaded machine, must ' _ms

senen SteueφrogΓamms in front - .. nt, as circuit precautions to protect this ^ sxeuc ¹ H & ·

To carry out order. But this is only meaningful then. The rest of the leiiα w \

full if the loader itself is protected against changes, the so-called customer specification "

protects in, since a change, for example, the prii- not protected against customer accessibility m

fen could disable function. Another is the problematic P ™ B ™ "™" ° £

Disadvantage of the customer wanting to run this test algorithm as a circuit. Da, de. "JVP ^U J

To develop order consists in the fact that in general a lrns ^ chCT ^

Äd d S h Iftion not without «

To develop order consists in the fact that with ge «rather (M ^ 2 i g ^

did not want changes to the control program without your information

the loader would have to be changed, whereby the Ko- can be read out there is a ^

most of the system would increase. from two partial cycles, the reading cycle

It is therefore the object of the invention to provide a one-write cycle. 1 ™ ^ ^W ™ ^^ Tdressf zur

indicate the direction that the loading and control pro- 30 adressenreg.ster (SAR) 3 is located «per aar *

an electronic data processing system addressing the desired memory control

tchine protects against undesired changes and det and the I "™ ™ ⁰ " in this position

thereby avoiding the named disadvantages. read out into the memory data register (SDR) S.

For oday facility in electronic data encryption during the write cycle erfogt d '^' ^ processing machines to protect the Ladepro- 35 this information in ^ur P ^{r "n} | ^llchen (Ld) il üb d lock switch (mn *

processing machines to protect the Ladepro- 35 of this information in the ^ur;. P ^r '| Program (supercharger) and by the loading program steep over the locking switch (mn * read in the control program against faulty As F i g 1 further shows, Kannu.

or undesired change, the invention consists not only of the memory data that a device for transmitting the information can be regenerated, a subroutine for reading in the second 40, for example, of the ^ 'part of the loader and checking of the loader and control and logical unit (ALU) " present information program on machine affiliation" in a first part of the loader through the memory address register J in the memory location defined against customer access during the read cycle gc protected control part of the main memory that is also stored. This last-mentioned »ate ^ d a device for transferring the data from an Un- 45 can, however, be blocked for the transfer by emc special control information t subprogram for loading functions. This is shown in F ^ ig 1J = ¹¹ ^ ⁸ ™ of the information from the input to the command area, by this control signal via a verter existing in the memory and for error detection. a gate circuit 6 controls a 1ntor second portion of the loader in the unprotected se matiensübertragung of the ^{ar-specific 'tn, met.' "u" a} '° ^fe part of the main memory and that finally such a see unit wrhndert 8 to the lock switch 4 A facility is provided which, as already mentioned in the introduction, «st it

protected part w of the main memory during the laser for small data processing machines, chh that dens of the charger and the control program to the charger for charging the ^tax P ^ro protects 8rarnrncs be change. Developments of the invention züglich its cost not au ^fwe ™ ^{'g' da} ^ ^r are presented in the dependent claims. 55 not insignificant _ to ^{d s. Ges} »™ ^t ^ ° ^st ^ _?" _Uc ^I } Jen

The achieved by the subject matter of the invention, chine is involved. The ^ - ^α «™haben £. The advantage of this is essentially the cost reduction as a small microprogram, ^ J °° ™ % ™ _c decoration of the device for protecting the loading procedures is carried out, the program and the control program are advantageously split into two parts:

wanted change, especially with small 60 customers

Machinery is particularly beneficial. In. a first part of the m .the "learning K _u ends

In the following, an exemplary embodiment of the control value 1, which is theoretically never accessible, is given

findungln hand of the drawings described in more detail- ^^^, ^^ S Spf-

Fi ?! d ^{8 he} block diagram of part of the central 6 ₅ gram part and consists of such routines,

unit of a smaller electronic data processor that checks Jes control program on Ma-

processing machine with the control memory, in which the sch.nenzuehongke, make, and

Control program is read in, with it and that in a second part, which is initially in the unge

protected, d. H. the customer accessible part of the main memory 2 is read and in essentially consists of routines, which load functions, such as transferring the Data and instructions from the input to the command area, including memory shifts, Print out a loading list, perform error detection, etc.

The first part of the loader, as well as the entire control program after the load operation has been carried out, is located in the principally protected control part 1 of the main memory. The second part against it is located in the initially unprotected part of the main memory, the so-called customer memory. However, it must also be possible to protect this part while the loading operation is being carried out, so that a change in the approved control program by the user in both the intended, as well as inadvertently impossible. The maintenance staff must be able to make this change however, it must be given in each case and it must apply to both the control part 1 of the main memory 2 as well as the customer memory while the loading operation is being carried out relate.

The protection of the second part of the loader must primarily relate to the fact that

1.Manual changes to the program in the memory using logic circuits (see Fig. 2) be suppressed and

2. A premature termination of the program loading due to a system reset for security reasons must be allowed, it is allowed, but no execution of the loaded program takes place as long as the load operation has not been run through completely.

As in connection with FIG. 2 will be explained in detail by means of a unstable switch, which is set for loading the program when the start button is pressed and is only reset by an instruction after completion of the full loading. Be it in this context reminded once again that these two locking functions of the Maintenance personnel must be able to be picked up.

In known machines is therefore on the control panel one only through a security key operable switch provided which can switch the machine from the user mode to the maintenance mode. When the machine is in the maintenance mode, the program loading is started by a Program load switch is operated. This puts the first card in the control section 1 of the main memory 2 locked in. It is possible to use the address switch on the console to locate the location in the Define memory into which the first card is read.

If, on the other hand, the machine is in user mode is located, the first card is forced to be read in at a fixed, previously defined address.

Simultaneously with the pressing of the starting load, the control signal D crzeuct, which corresponds to the one shown in FIG. 2 illustrated bistable switch 9 switches to its "1" position. When this bistable switch is set, the machine can only read cards and process their contents. The other functions of the input / output devices, such as printing. Punching, reading or writing from disk storage and the like are temporarily blocked. However, these functions can also be carried out and used in the maintenance mode.

ίο While the control program is being loaded, you can all processing functions of the central unit of the electronic data processing machine the entire core memory can be used. The start of processing during this However, the operating mode is forcibly entered in the main memory controls after a card has been read relocated.

However, the system can only exit the charging operating mode if the aforementioned unstable Switch is reset. As already mentioned, this is done by means of a microprogram routine carried out, which is located in the control section of the main memory. When the bistable switch so is reset again, the machine can the Exit charging mode and return to user mode, d. H. pass to the processing plant.

As part of the loading program, the following program parts are stored in the control memory:

The first part of the loader for loading the control program,

the test algorithm and test data to ensure that a correct loader is included would,

another checking algorithm to ensure that the correct control program is cingelescn was, and

the instruction, with the help of which the bistable Schaller switches from the loading mode to the user mode is switched.

Since the control part of the main memory is not accessible to the customer, the following functions to be carried out:

It is first made sure that the loader was loaded correctly and that it is impossible is to change him;

it is also ensured that the correct control program has been loaded and that it is impossible to change this too, and
the bistable switch is switched over when the correct control program has been loaded.
55

As already mentioned, the control part 1 of the main memory 2 contains all the information that is necessary is to check the correctness of the loader. As the test data for the control program part of the loader the control section does not allow any changes to the control program.

F i g. 2 now shows a circuit arrangement with the aid of which the for carrying out the loading operation used customer memory is locked for the user during the load operation. As already Mentioned several times, however, this sounding must have access to it for the maintenance personnel Enable storage. By pressing the start button

it will be able to become the Si for the start of the loading operation, since the AND circuit 6 in FIG. 1 generates a signal which controls the bistable switch 9 in the transmission of information to the locking switch in a "!" position. The »!« Output signal this4 and from there into memory2 enables
This switch becomes an input of the AND gate

11 transferred. Only if the operating mode switch is 5 Brief summary
is not set to maintenance mode, it delivers

a "(!" signal, which is sent to the input of the inverter 10 The loader executed as a microprogram for the is transmitted. The output signal of this inverter loads the control program into the control part of the is a binary "1", which is also part of the AND switch main memory of electronic data processing 11 is transmitted. If the user manipulates io Uingsmaschine consists of 2 parts, the first of which intentionally or inadvertently with certain, in the case of part, routines for withdrawing the cards of the second Most data processing machines contain part, as well as routines for checking the lane Functions that allow informers to be written to ensure that the correct loader is in tion into the main memory, then the system is loaded. The second part is located a signal β is generated, which now contains the AND switch 15 temporarily in the customer memory and ment U opens, which then has a "1" at its input - the essential charging functions, such as transmission Output signal generated. This signal becomes that of the data and instruction from the input to the Be inverter transmitted in Fig. 1, which this signal is in error range.

converts a binary "0". As a result, the two

for example via the arithmetic and logical 20 sensitive first part of the loader

Circuit 8 carried out memory change radio protection is that it is in a by the user

tion blocked because the AND circuit 6, which is located in the inaccessible memory section, must

Data path runs, is locked. second part, which is normally accessible

If the operating mode switch is in the customer's part, be protected. For this purpose

If the maintenance company is located, then it generates the 25 logic circuits used which are essentially

Signal / 4, which corresponds to a binary "1". The outcrop consist of a bistable switch that works with

output of the inverter 10 in Fig. 2 converts this signal, the beginning of the charging routine is set, and prevents

at its output in a binary "0", so that it changes that other than the load data and instructions

AND circuit 11 is blocked. The output signals can be read into the machine. At the end

gnal E then corresponds to a binary "0". The importance of the loading operation is made with the help of a special one

This means that the data processing microinstruction is now back on this switch in maintenance mode.

processing machine by the maintenance staff also during, so that now the machine for the user pro

'the load operation memory changes performed is released.

1 sheet of drawings

3633

Claims (4)

Patent claims: 1. Device in electronic data processing machines to protect the loading program (Loader) and the control program to be read in by the loader program against incorrect or undesired changes, whereby the control program is used to interpret customer programs, thereby making ίο indicates that a device for transmitting the from a subroutine to Reading in the second part of the loader and for checking the loader and control program for machine affiliation existing first part of the loader in the protected against customer access Control part (1; Fig. 1) of the main memory (2) that also has a device for transmitting the from a subroutine for loading functions for the transfer of the information from the input to the Command area of the memory and the second part of the loader for error detection in the inherently unprotected part of the main memory and that finally a device (Fig. 2) is provided that the inherently unprotected Part of the memory while the loader and the control program are being loaded Change protects. 2. Device for protecting the per se unprotected part of the main memory during the loading of the loader and control program according to claim 1, characterized in that a bistable switch (9; Fig. 2) is provided which is triggered by a start signal (D) at the beginning of Load operation in its binary "!" Position is controlled so that this "!" Output signal is transmitted to an AND circuit (II) whose other input signal (B) is present when an information change is to be carried out in the memory, the output signal (£) this AND circuit blocks the rewriting of memory information (Fig. 1), but does not block the memory regeneration and that the bistable switch is reset again at the end of the loading operation by a signal (C) derived from a special microinstruction, so that information changes can be carried out in the unprotected part of the main memory. 3. Device according to claim 2, characterized in that the AND circuit (11; F i g. 2) has a further input which generates the memory lock signal via a signal (A) generated only by the maintenance staff via the inverter (10) (E) prevented. 4. Device according to claim 2 and / or 3, characterized in that the bistable switch (9; F i g. 2) is constructed as a locking circuit.