JP4399270B2 - データプロセッサのセキュリティを改善させるための方法ならびに装置 - Google Patents
データプロセッサのセキュリティを改善させるための方法ならびに装置 Download PDFInfo
- Publication number
- JP4399270B2 JP4399270B2 JP2003581029A JP2003581029A JP4399270B2 JP 4399270 B2 JP4399270 B2 JP 4399270B2 JP 2003581029 A JP2003581029 A JP 2003581029A JP 2003581029 A JP2003581029 A JP 2003581029A JP 4399270 B2 JP4399270 B2 JP 4399270B2
- Authority
- JP
- Japan
- Prior art keywords
- memory
- segment
- preselected
- address
- recorded
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
- G06F12/1416—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights
- G06F12/145—Protection against unauthorised use of memory or access to memory by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F12/00—Accessing, addressing or allocating within memory systems or architectures
- G06F12/14—Protection against unauthorised use of memory or access to memory
- G06F12/1458—Protection against unauthorised use of memory or access to memory by checking the subject access rights
- G06F12/1491—Protection against unauthorised use of memory or access to memory by checking the subject access rights in a hierarchical protection system, e.g. privilege levels, memory rings
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
- G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Storage Device Security (AREA)
Description
Claims (5)
- 複数の第1の特権レベルを有するコンピュータシステムにおいてメモリセグメントに記録されているデータに対するアクセスを制御する方法であって、
前記メモリセグメントは、第1の特権レベルに関連付けられたプロセスからアクセス可能な保護されていないデータを含み、前記第1の特権レベルは、コンピュータシステムのリソースへのアクセスが制限されており、
第1の予め選択されたメモリのセグメントのいずれかのロケーションに保護されたデータが記録されているかどうかを示す第1の情報を記録するステップと、
前記第1の予め選択されたメモリのセグメントのサブセットである、第2の複数の予め選択されたメモリのセグメントについて、各々のいずれかのロケーションに保護されたデータが記録されているかどうかを示す第2の情報を記録するステップと、
要求側のエージェントからアドレスを受け取るステップと、
受け取った前記アドレスの少なくとも一部が前記第1の予め選択されたメモリのセグメント内にあるかどうかを判定するステップと、
記録された前記第1の情報が、前記第1の予め選択されたメモリのセグメントが保護されたデータを有さないことを示す場合、前記アドレスへのアクセスを許可するステップと、
記録された前記第1の情報から、前記第1の予め選択されたメモリのセグメントが保護されたデータを有すると判定した場合、前記第2の予め選択されたメモリのセグメントのうち、受け取った前記アドレスが位置する少なくとも1つのセグメントを識別するステップと、
識別された前記第2の予め選択されたメモリのセグメントに対応する記録された前記第2の情報が、その第2の予め選択されたメモリのセグメントが保護されたデータを有さないことを示す場合、受け取った前記アドレスへのアクセスを許可するステップと、
前記第2の予め選択されたメモリのセグメントが保護されたデータを有する場合、複数の第2の特権レベルのうち選択された1つ及び前記複数の第1の特権レベルのうち選択された1つを有する前記要求側のエージェントに応じて、受け取った前記アドレスへのアクセスを許可するステップと、
を有する方法。 - 第1の予め選択されたメモリのセグメントのいずれかのロケーションに保護されたデータが記録されているかどうかを示す第1の情報を記録するステップは、前記第2の複数のメモリのセグメントのいずれかが保護されたデータを記録している場合に情報の単一のビットを記録するステップをさらに有する請求項1に記載の方法。
- 第2の複数の予め選択されたメモリのセグメントの各々のいずれかのロケーションに保護されたデータが記録されているかどうかを示す第2の情報を記録するステップは、隣接する複数の第2の予め選択されたセグメントの各々のいずれかのロケーションに保護されたデータが記録されているかどうかを示す第2の情報を記録するステップをさらに有する請求項1に記載の方法。
- 受け取った前記アドレスの少なくとも一部が前記第1の予め選択されたメモリのセグメント内にあるかどうかを判定するステップは、受け取った前記アドレスの少なくとも一部が前記隣接する複数の第2の予め選択されたセグメント内にあるかどうかを判定するステップをさらに有する請求項3に記載の方法。
- 記録された前記第1の情報から、前記第1の予め選択されたメモリのセグメントが保護されたデータを有すると判定した場合、前記第2の予め選択されたメモリのセグメントのうち、受け取った前記アドレスが位置する少なくとも1つのセグメントを識別するステップは、受け取った前記アドレスと、この第2の予め選択されたメモリのセグメントの少なくとも1つに対応するアドレス範囲と、を比較するステップをさらに有する請求項1に記載の方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/107,633 US7571318B2 (en) | 2002-03-27 | 2002-03-27 | Method and apparatus for improved security in a data processor |
PCT/US2002/041663 WO2003083673A1 (en) | 2002-03-27 | 2002-12-20 | Method and apparatus for improved security in a data processor |
Publications (2)
Publication Number | Publication Date |
---|---|
JP2005521943A JP2005521943A (ja) | 2005-07-21 |
JP4399270B2 true JP4399270B2 (ja) | 2010-01-13 |
Family
ID=28452679
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
JP2003581029A Expired - Lifetime JP4399270B2 (ja) | 2002-03-27 | 2002-12-20 | データプロセッサのセキュリティを改善させるための方法ならびに装置 |
Country Status (8)
Country | Link |
---|---|
US (1) | US7571318B2 (ja) |
JP (1) | JP4399270B2 (ja) |
KR (1) | KR101000543B1 (ja) |
CN (1) | CN1315061C (ja) |
AU (1) | AU2002359879A1 (ja) |
DE (1) | DE10297688B4 (ja) |
GB (1) | GB2402782B (ja) |
WO (1) | WO2003083673A1 (ja) |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050033979A1 (en) * | 2003-08-08 | 2005-02-10 | Hyser Chris D. | Method and system for secure direct memory access |
US7454787B2 (en) * | 2004-01-13 | 2008-11-18 | Hewlett-Packard Development Company, L.P. | Secure direct memory access through system controllers and similar hardware devices |
US7457832B2 (en) | 2004-08-31 | 2008-11-25 | Microsoft Corporation | Verifying dynamically generated operations on a data store |
EP1742152B1 (en) * | 2005-07-07 | 2012-09-12 | Texas Instruments Inc. | Method and system for a multi-sharing memory access control |
US7752444B2 (en) * | 2005-12-21 | 2010-07-06 | Nortel Networks Limited | System and method for providing identity hiding in a shared key authentication protocol |
CN101079083B (zh) * | 2006-05-25 | 2010-05-12 | 中国科学院计算技术研究所 | 一种对访存操作进行权限检查的系统、装置及方法 |
US9129071B2 (en) * | 2012-10-24 | 2015-09-08 | Texas Instruments Incorporated | Coherence controller slot architecture allowing zero latency write commit |
US9378152B2 (en) * | 2014-05-09 | 2016-06-28 | Avago Technologies General Ip (Singapore) Pte. Ltd. | Systems and methods for I/O processing using out-of-band hinting to block driver or storage controller |
US9563382B2 (en) | 2014-06-05 | 2017-02-07 | Sandisk Technologies Llc | Methods, systems, and computer readable media for providing flexible host memory buffer |
US9507722B2 (en) | 2014-06-05 | 2016-11-29 | Sandisk Technologies Llc | Methods, systems, and computer readable media for solid state drive caching across a host bus |
US10007442B2 (en) * | 2014-08-20 | 2018-06-26 | Sandisk Technologies Llc | Methods, systems, and computer readable media for automatically deriving hints from accesses to a storage device and from file system metadata and for optimizing utilization of the storage device based on the hints |
US10228854B2 (en) | 2014-08-20 | 2019-03-12 | Sandisk Technologies Llc | Storage devices and methods for optimizing use of storage devices based on storage device parsing of file system metadata in host write operations |
US10268584B2 (en) | 2014-08-20 | 2019-04-23 | Sandisk Technologies Llc | Adaptive host memory buffer (HMB) caching using unassisted hinting |
US9927997B2 (en) | 2015-12-21 | 2018-03-27 | Sandisk Technologies Llc | Methods, systems, and computer readable media for automatically and selectively enabling burst mode operation in a storage device |
US10521118B2 (en) | 2016-07-13 | 2019-12-31 | Sandisk Technologies Llc | Methods, systems, and computer readable media for write classification and aggregation using host memory buffer (HMB) |
US10936826B2 (en) | 2018-06-14 | 2021-03-02 | International Business Machines Corporation | Proactive data breach prevention in remote translation environments |
US10884920B2 (en) | 2018-08-14 | 2021-01-05 | Western Digital Technologies, Inc. | Metadata-based operations for use with solid state devices |
CN109033775A (zh) * | 2018-09-03 | 2018-12-18 | 东莞华贝电子科技有限公司 | 一种访问权限的远程控制方法及系统 |
US11340810B2 (en) | 2018-10-09 | 2022-05-24 | Western Digital Technologies, Inc. | Optimizing data storage device operation by grouping logical block addresses and/or physical block addresses using hints |
US11249664B2 (en) | 2018-10-09 | 2022-02-15 | Western Digital Technologies, Inc. | File system metadata decoding for optimizing flash translation layer operations |
Family Cites Families (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0481735A3 (en) * | 1990-10-19 | 1993-01-13 | Array Technology Corporation | Address protection circuit |
US6003117A (en) * | 1997-10-08 | 1999-12-14 | Vlsi Technology, Inc. | Secure memory management unit which utilizes a system processor to perform page swapping |
US6154818A (en) * | 1997-11-20 | 2000-11-28 | Advanced Micro Devices, Inc. | System and method of controlling access to privilege partitioned address space for a model specific register file |
US6516395B1 (en) * | 1997-11-20 | 2003-02-04 | Advanced Micro Devices, Inc. | System and method for controlling access to a privilege-partitioned address space with a fixed set of attributes |
US6748592B1 (en) * | 2000-02-14 | 2004-06-08 | Xoucin, Inc. | Method and apparatus for protectively operating a data/information processing device |
US7216345B1 (en) * | 2000-04-07 | 2007-05-08 | Hall Aluminum Llc | Method and apparatus for protectively operating a data/information processing device |
WO2002006929A2 (en) * | 2000-07-18 | 2002-01-24 | Intel Corporation | Controlling access to multiple isolated memories in an isolated execution environment |
CN1291747A (zh) * | 2000-11-24 | 2001-04-18 | 李楠甍 | 高速缓存设备及其使用方法 |
US7073059B2 (en) * | 2001-06-08 | 2006-07-04 | Hewlett-Packard Development Company, L.P. | Secure machine platform that interfaces to operating systems and customized control programs |
US6745307B2 (en) * | 2001-10-31 | 2004-06-01 | Hewlett-Packard Development Company, L.P. | Method and system for privilege-level-access to memory within a computer |
-
2002
- 2002-03-27 US US10/107,633 patent/US7571318B2/en active Active
- 2002-12-20 GB GB0420638A patent/GB2402782B/en not_active Expired - Lifetime
- 2002-12-20 CN CNB028286057A patent/CN1315061C/zh not_active Expired - Lifetime
- 2002-12-20 JP JP2003581029A patent/JP4399270B2/ja not_active Expired - Lifetime
- 2002-12-20 AU AU2002359879A patent/AU2002359879A1/en not_active Abandoned
- 2002-12-20 WO PCT/US2002/041663 patent/WO2003083673A1/en active Application Filing
- 2002-12-20 KR KR1020047014469A patent/KR101000543B1/ko active IP Right Grant
- 2002-12-20 DE DE10297688T patent/DE10297688B4/de not_active Expired - Lifetime
Also Published As
Publication number | Publication date |
---|---|
US20030188184A1 (en) | 2003-10-02 |
DE10297688B4 (de) | 2006-12-14 |
KR101000543B1 (ko) | 2010-12-14 |
GB2402782B (en) | 2005-11-02 |
CN1315061C (zh) | 2007-05-09 |
KR20040101310A (ko) | 2004-12-02 |
DE10297688T5 (de) | 2005-06-30 |
AU2002359879A1 (en) | 2003-10-13 |
JP2005521943A (ja) | 2005-07-21 |
GB0420638D0 (en) | 2004-10-20 |
GB2402782A (en) | 2004-12-15 |
WO2003083673A1 (en) | 2003-10-09 |
US7571318B2 (en) | 2009-08-04 |
CN1623142A (zh) | 2005-06-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP4399270B2 (ja) | データプロセッサのセキュリティを改善させるための方法ならびに装置 | |
US6678825B1 (en) | Controlling access to multiple isolated memories in an isolated execution environment | |
US7127579B2 (en) | Hardened extended firmware interface framework | |
US6745306B1 (en) | Method and system for restricting the load of physical address translations of virtual addresses | |
US6633963B1 (en) | Controlling access to multiple memory zones in an isolated execution environment | |
US6986006B2 (en) | Page granular curtained memory via mapping control | |
US6934817B2 (en) | Controlling access to multiple memory zones in an isolated execution environment | |
RU2510074C2 (ru) | Система и способ проверки исполняемого кода перед его выполнением | |
US5657445A (en) | Apparatus and method for limiting access to mass storage devices in a computer system | |
KR100975981B1 (ko) | 보안 실행 모드 하에서 보안 커넬을 사용하는 트러스트된클라이언트 | |
JP3982687B2 (ja) | 分離実行環境での複数の分離メモリへのアクセスの制御 | |
US7130977B1 (en) | Controlling access to a control register of a microprocessor | |
JP2013522702A (ja) | メモリのセキュア領域および非セキュア領域へのセキュアモードページテーブルデータの格納 | |
JP2004530979A (ja) | メモリの一部を保護するための方法および装置 | |
KR100931706B1 (ko) | 타겟 보안을 결정하기 위한 물리적 어드레스-기반 보안에관한 방법 및 장치 | |
CN110532767B (zh) | 面向sgx安全应用的内部隔离方法 | |
JP2005512228A (ja) | 強化されたメモリアクセスセキュリティを提供する、メモリに対するデバイスのアクセスを制御するシステムおよび方法 | |
JP2001005726A (ja) | メモリアドレス空間拡張装置及びプログラムを記憶した記憶媒体 | |
JP2023526811A (ja) | タグチェック装置及び方法 | |
JP2008234248A (ja) | プログラム実行装置及びプログラム実行方法 | |
US7089418B1 (en) | Managing accesses in a processor for isolated execution | |
KR100939328B1 (ko) | 보안민감명령들의 제한실행을 위한 방법 및 장치 | |
JP4478458B2 (ja) | 所望のセキュリティを用いた入出力デバイスにアクセスするための方法及び装置 | |
JP2001249848A (ja) | 先行特権レベルに基づく特権昇格 | |
US6889308B1 (en) | Method and apparatus for protecting page translations |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
A621 | Written request for application examination |
Free format text: JAPANESE INTERMEDIATE CODE: A621 Effective date: 20051205 |
|
A131 | Notification of reasons for refusal |
Free format text: JAPANESE INTERMEDIATE CODE: A131 Effective date: 20090526 |
|
A521 | Request for written amendment filed |
Free format text: JAPANESE INTERMEDIATE CODE: A523 Effective date: 20090826 |
|
TRDD | Decision of grant or rejection written | ||
A01 | Written decision to grant a patent or to grant a registration (utility model) |
Free format text: JAPANESE INTERMEDIATE CODE: A01 Effective date: 20090929 |
|
A01 | Written decision to grant a patent or to grant a registration (utility model) |
Free format text: JAPANESE INTERMEDIATE CODE: A01 |
|
A61 | First payment of annual fees (during grant procedure) |
Free format text: JAPANESE INTERMEDIATE CODE: A61 Effective date: 20091026 |
|
FPAY | Renewal fee payment (event date is renewal date of database) |
Free format text: PAYMENT UNTIL: 20121030 Year of fee payment: 3 |
|
R150 | Certificate of patent or registration of utility model |
Ref document number: 4399270 Country of ref document: JP Free format text: JAPANESE INTERMEDIATE CODE: R150 Free format text: JAPANESE INTERMEDIATE CODE: R150 |
|
FPAY | Renewal fee payment (event date is renewal date of database) |
Free format text: PAYMENT UNTIL: 20121030 Year of fee payment: 3 |
|
FPAY | Renewal fee payment (event date is renewal date of database) |
Free format text: PAYMENT UNTIL: 20131030 Year of fee payment: 4 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
R250 | Receipt of annual fees |
Free format text: JAPANESE INTERMEDIATE CODE: R250 |
|
EXPY | Cancellation because of completion of term |