GB2195477A

GB2195477A - Data processing system security

Info

Publication number: GB2195477A
Application number: GB08622572A
Authority: GB
Inventors: Roger Russell; Neil Tracey Wignal Charrington
Original assignee: Individual
Current assignee: Individual
Priority date: 1986-09-19
Filing date: 1986-09-19
Publication date: 1988-04-07
Anticipated expiration: 2006-09-19
Also published as: ZA877033B; EP0325598A1; WO1988002142A1; GB8622572D0; AU608779B2; AU7967187A; GB2195477B

Abstract

A first security program (Y) is initially installed in the long-term storage region (16) together with a second security program (Z). A date item (X) is also installed in another long-term storage region (15). The first security program (Y) tests whether the current date provided by a calendar (C) is the same as the installation date in item (X) and, only if true, creates a copy (X') in a region (11) of long-term storage. The copy (X') is arranged to not allow copying of itself. The security program (Y) finally deletes itself. The second security program (Z) requires absence of the program (Y) and presence of an accurate copy (X') in the region (11) before user access to the main contents of regions (15) and (16) is allowed.

Description

SPECIFICATION Data processing system security This invention relates to the prevention of unauthorised use of a data processing system.

Data processing systems comprising a central processing unit and long-term storage means such as disc drives with magnetic discs are typically adapted for use in carrying out desired operations by the installation of sequences of instructions and information in the long-term storage means. The adaption of a system by an unauthorised person to carry out a particular operation by the installation of the necessary sequence of instructions and information is a problem which the present invention aims to make very difficult or impossible, especially where the system includes a time keeping means.

The invention and preferred features of embodiments thereof are defined in the claims hereinafter.

A preferred embodiment of the invention will now be described with reference to the accompanying drawings in which: Fig. 1 is a diagrammatic representation of the memory contents of a data processing system.

Fig. 2 is a diagrammatic representation of the memory contents of the system during installation of a sequence of instructions and information in accordance with the invention; Fig. 3 is a diagrammatic representation of the memory contents of the system after installation of the said sequence; Fig. 4 is a diagrammatic representation of the contents of another system after unauthorised copying thereto of the contents represented in Fig. 3.

Fig. 1 represents a memory map of a data processing system using virtual memory. An example of such a system is a generalised data base management computer system known as Ultimate produced by Pick & Associates Inc. of Irvin, California, United States of America. The physical basis of the memory map of Fig. 1 is a long-term storage means in the form of magnetic data storage discs in a disc drive, together with a semi-conductor main memory and semi-conductor ROM holding invariable instructions and information. In operation, instructions and information held on disc in the long-term storage means are loaded into the main memory as required for immediate use on a page by page basis.In Fig. 1, the memory area is divided into three main regions: a system inventory region 11 which contains directories of programs and information files; a system programs region 12 which contains the programs listed in the system inventory and used in operating the basic functions of the data processing system, and an unoccupied region 13 into which further programs and information can be written through the system. The data stored in the region 13 is stored on disc in the disc drive.

In this example, the system programs include a calendar program C which runs continually from some specific point in time and provides a continually updated representation of time, including the date. This means for providing temporal information may comprise a ROM program and assigned locations in the main memory at which the representation of date and time are stored.

Fig. 2 represents the memory map of Fig. 1 during installation of a program stored on tape in tape cassette 14. The tape stores, in sequence, an auxiliary loader program, a main loader program, and a program of instructions and information to be loaded into the region 13 of the memory space of the data processing system. The auxiliary loader program is loaded first onto disc in the region 13 and then runs, causing the tape in the cassette 14 to be rewound to its beginning, three end of file markers followed by an end of storage medium instruction to be written over the initial portion of the auxiliary loader program on the tape, and the tape to be moved forward to the next end of the file marker which is at the beginning of the main loader program.The main loader program is then written to disc, i.e., loaded through the system into the region 13, by the auxiliary loader system, and run from the disc. The main loader program initially deletes the auxiliary loader program from disc (region 13), then causes the said program of instructions and information to be written to disc. The main loader program finally rewinds the tape in the cassette 14 and causes itself to be deleted from disc. Thus the contents of the tape can no longer be loaded into a system.

The said program of instructions and information is distributed into two areas of the region 13, a first region 15, labelled APPLiCA- TION in Fig. 2, and a second region 15, labelled PROGRAMS in Fig. 2. The region 15 contains the information and the region 16 contains the instructions of the said program.

Amongst the information is a predetermined item X which, in this example, represents a particular date and other details.

The instructions in region 18 include two security programs Y and Z. The security program Y is arranged to run immediately the first attempt to use the data in regions 15 and 16 is made. The authorised user is instructed to make this first attempt on the authorised date of installation which is the date represented in the item X.

When the security program Y runs, it first tests whether item X is also stored in a predetermined location in the region 11, and if it is, branches to an abort program in the region 16 which prevents further use of the data regions 15 and 16 and causes suitable warning notices to be displayed to the user.

If the item X is not present in region 11 at this test, the program Y compares the date in item X in region 15 with the date currently indicated by the calendar program C. If the dates are not the same, Y again branches to the abort program. If the dates are the same, program Y proceeds to cause a copy of item X to be written into the predetermined location in region 11. The copy, X', is created in such a way that a further copy cannot be made from X'. This can be achieved by a suitable flag or other means, depending on the details of the operation of the system. The copy item X' is indicated in Fig. 3 which shows the memory map after installation, including the running of program Y. After the copy item X' has been written, program Y ends by deleting itself. Thus the system no longer c#ontains the security program Y, which was the means by which the copy item X' was created.

At any subsequent attempt to use the data stored in regions 15 and 16, the security program Z runs first.

The item X and its copy X' include in addition to a date a current password code. When a user attempts to use the data stored in regions 15 and 16, the program Z requires the user to enter, through a keyboard for example, a password. The password entered by the user is compared with the code held as part of X and, if this comparison is satisfied, tests whether the copy X' exists in region 11. If the password entered is not correct or the copy X' does not exist, the program Z branches to the abort program. The password code may be derived from a user name code also included in the item X.

If the entered password is correct and the copy X' exists in region 11, the copy X' is compared with the item X and if there is a difference between any of the information in the copy X' on the one hand and the item X on the other hand, the program Z branches to the abort program.

Finally, the security program Z tests whether the security program Y exists in region 16 and if Y is found to exist, the program Z branches to the abort program. If program Y does not exist, the user is permitted to use the data in regions 15 and 16, i.e., to execute programs held in region 16 and to process information held in region 15 or entered into the system during execution of the programs in region 16.

The program Z may also carry out a test on the calendar C such that at predetermined numbers of days from the installation date, the program Z requires a new password to be entered by the user. When the user enters the new password, the program Z may write the new date into the item X and its copy X'. If the new password is not entered or an incorrect new password is entered by the user, the program Z branches to the abort program.

Fig. 4 represents the memory map of a data processing system of a type capable of utilizing the contents of the memory map of Fig. 3 but having had entered into it an unauthorised copy of the contents of the memory map of Fig. 3. Since the copy item X' is arranged to frustrate copying, no copy X' is present in region 11 of the map of Fig. 4. Consequently any attempt to use the contents of regions 15 and 16 will fail since the security program Z, which has been copied, will test for the presence of X', and on finding that X' is not present will branch to the abort program. Thus the deletion of the security program Y and the frustration of copying of the copy item X', together with the tests carried out by the security program Z, ensure that an unauthorised copy cannot be used.

It should be noted that the test carried out by the security program Y to check whether the current date represented by the calendar C is the same as the date encoded in the item X ensures that unauthorised use of the cassette 14 on any day which is not the authorised installation day prevents proper installation of the contents of the tape, since the copy item X' will not be created, and the security program Y will not be deleted. Furthermore, no access to the main contents of the regions 15 and 16 will be allowed since the program Y branches to the abort program.

The use of an authorised installation date allows the intended user 24 hours to complete proper installation. Other arrangements can be made, for example by restricting the authorised installation time to a defined period of a particular day. The temporal information in the item X may then be a particular date together with a defined period such as 10 a.m. to 2 p.m. Alternatively, only a defined period within any day may be chosen, such as 10 a.m. to 2 p.m. with no restriction to a particular date. A set of separated or adjacent days may be defined. However, for maximum security it is preferred to define one date and a period of time on that date.

The method is preferably utilized with a virtual memory system, or at least in a system in which data can be accessed very rapidly by the processing unit or units of the system.

Claims

1. A method of preventing unauthorised use of a data processing system having means for long-term storage of data written thereto through the system and means providing temporal information, the method comprising the steps of: writing a sequence of operating instructions and information into the long-term storage means; and executing an initial part of the said sequence, the initial part including a predetermined item of temporal information and the steps of comparing the current temporal infor mation provided by the said temporal information providing means with the said item, and executing the remainder of the said initial part if the predetermined item and the current tem poral information are determined by the said comparison to be compatible with each other, or executing a predetermined abort portion of the said sequence if the said item and the current temporal information are determined by the said comparison to be not compatible with each other,the said predetermined abort portion providing no access to the remainder of the sequence.

2. A method according to claim 1, wherein execution of the said remainder of the said initial part ends with deletion of the said initial part from the long-term storage means.

3. A method according to claim 2, wherein deletion of the said initial part is immediately preceded by deletion of information stored in the long-term storage means to identify the said initial part.

4. A method according to claim 2 or 3, further including the steps of testing whether the said initial part is present in the long-term storage means and restricting subsequent execution to a predetermined abort portion of the said sequence if the said initial part is present the steps of testing and restricting being executed in response to accessing of a further portion of the said sequence following the said initial part.

5. A method according to claim 4, wherein the first and second said abort portions are the same portion of the said sequence.

6. A method according to any preceding claim,wherein execution of the said initial part includes making a copy in the long-term storage means of a predetermined portion of the said sequence including the said predetermined item in such a manner that copying of the contents of the long-term storage means into further long-term storage means coupled to the data processing system fails to reproduce in the further long-term storage means the said copy.

7. A method according to claim 6, further including the steps of testing whether the said copy is present in the first said long-term sto rage means and restricting execution to a predetermined abort portion of the said sequence if the said copy is not present, the step of testing for the presence of the said copy be ing executed in response to accessing of a or the said further portion of the said sequence following the said initial part.

8. A method according to claims 4 and 7, wherein the said abort portions are one and the same portion of the said sequence.

9. A method according to any preceding claim wherein the said sequence is written into the first said long-term storage means from a portable long-term storage means, the portable long-term storage means having stored therein an auxiliary loader sequence, a main loader sequence, and the said sequence of operating instructions and information, and the step of writing the said sequence of operating instructions and information into the first said long-term storage means comprises the steps of writing the auxiliary loader sequence from the portable long-term storage means to the first said long-term storage means and executing the auxiliary loader sequence from the first said long-term storage means whereby the beginning of the auxiliary loader sequence in the portable long-term storage means is over-written by instructions including an end of storage indicator, the main loader sequence is written into the first said longterm storage means from the portable longterm storage means, and the auxiliary loader sequence is deleted from the first said longterm storage means, and executing the main loader sequence from the firstsaid long-term storage means whereby the said sequence of instructions and information is written from the portable long-term storage means to the first said long-term storage means, access to the portable long-term storage means is restricted to a beginning region terminated by the said end of storage indicator, and the main loader sequence is deleted from the first said long-term storage means.

10. A method of preventing unauthorised use of a data processing system having means for long-term storage of data written thereto through the system, the method comprising the steps of: writing a sequence of operating instructions and information into the long-term storage means; executing an initial part of the said sequence, the execution of the said initial part including making a copy in the long-term storage means of a predetarmined item of information in the said sequence and deleting the said initial part from the long-term storage means; testing whether the said copy is present in the said long-term storage means; and restricting execution to a predetermined abort portion of the said sequence if the said copy is not present, the steps of testing being executed in response to accessing of a further portion of the said sequence following the said initial part.

11. A method according to claim 10, wherein the making of the said copy is carried out in such a manner that copying of the contents of the long-term storage means into further long-term storage means coupled to the data processing system fails to reproduce in the further long-term storage means the said copy.

12. A method of preventing unauthorised use of a data processing system, substantially as described hereinbefore with reference to the accompanying drawings.