JPH03273349A - Access control system - Google Patents

Abstract

PURPOSE:To realize access control to a specified device by recognizing it based on the address of an instruction fetch to be executed by a CPU whichever the program of a priviledge class or of a non-priviledge class is under operating. CONSTITUTION:According to whether the address of the instruction fetch to be executed by the CPU 1 is corresponding to a ROM 2 of the priviledge class program or to a RAM 3 of the nonpriviledge class program, it is controlled in the manner of a hardware whether the write access to a device 9 is permitted or inhibited. Namely, when the ROM 2 is under operating, an FF 7 is turned to a set state and a write signal DEVWR is supplied to the device 9 via OR 8. On the other hand, when the RAM 3 is under operating, the FF 7 is turned to a reset state and the write signal DEVWR is stopped being supplied to the device 9.

Description

DETAILED DESCRIPTION OF THE INVENTION [Object of the Invention] (Industrial Application Field) The present invention relates to an access control method for a specific device of a computer system.

(Prior Art) Generally, in a computer system, multiple types of programs at different levels, such as operation programs and application programs, are operated. Since each of these programs has different processing contents and processing targets, access control can be carried out by, for example, allowing access to a specific device only by an operation program, and preventing access to that specific device by an application program. may be necessary.

Large-scale computer systems may have architectures that control access rights using flags that indicate the CPU or privileged class, or relatively simple computer systems that use a microprocessor as the CPU. Usually, the CPU does not have any function to control access rights. Therefore, in such a simple computer system, it is difficult to perform access control such as allowing access to a specific device only by an operation program and prohibiting access to that specific device by an application program. there were.

(Problem to be solved by the invention) Conventionally, in computer systems that use CPUs that do not have an access rights control function, access control has been implemented such as allowing only privileged programs to access specific devices. It was difficult to do so.

This invention was made in view of these points, and even when a CPU without an access right control function is used, it provides access control that allows only privileged programs to access a specific device. The purpose of this study is to provide an access control method that can realize the following.

[Structure of the Invention] (Means for Solving the Problems) The access control method according to the present invention includes a memory means in which privileged class programs and non-privileged class programs are stored, and instructions fetched from the memory means by a CPU. recognition means for recognizing whether the privileged class program or the non-privileged class program is being operated based on the instruction fetch address; and access when the recognition means recognizes the operation of the privileged class program. and signal generating means for generating a permission signal and generating an access prohibition signal when operation of the non-privileged class program is approved, and allowing only the privileged class program to access a specific device. Features.

(Operation) In this access control method, it is recognized which program, a privileged class program or a non-privileged class program, is being operated based on the address of an instruction fetch executed by the CPU, and it is specified based on the recognition result. access to devices is controlled. Therefore, even if a CPU without an access right control function is used, it becomes possible to permit only privileged programs to access a specific device.

(Example) Hereinafter, the present invention will be described in detail with reference to the drawings.

FIG. 1 shows an electronic computer system according to an embodiment of the present invention. This electronic computer system is CP
UI, ROM2, RAM3, access control unit 4,
OR gates 5, 6. ! ! , R-57 Rip #Flop 7
, specific device 9, address bus IL data bus 12,
A control bus 13 is provided.

The CPUI is for controlling the operation of the entire electronic computer system, and is connected to an address bus 11, a data bus 12, and a control bus 13. ROM
2 stores privileged class programs. R.A.
M3 stores non-privileged programs and various data necessary for data processing of each program.

The access control unit 4 generates a read signal (ROMRD) for the ROM 2 and a read/read signal for the RAM 3 based on the address data and control signal output from the CPU 1.
It generates a write signal (RAMRD/RAMWR), a signal representing instruction fetch (FETCH), and a write signal (DEVWR) for the specific device 9. These signals are all low active signals.

The S-R flip-flop 7 is set to the set state by the "L" level output of the OR gate 5, and is set to the reset state by the "L" level output of the OR gate 6. In the reset state, a Q output of "L° level" is generated, and in the reset state, a Q output of "H° level is generated. Therefore, the S-R
When the flip-flop 7 is in the set state, an “L” level write signal (DEVWR) is sent to the specific device 9.
) is supplied to the write control input WR of the specific device 9 via the OR gate 8.

On the other hand, when the SR flip-flop 7 is in the reset state, the OR gate 8 prohibits the supply of the "L-level write signal (DEVWR)" to the specific device 9 to the specific device 9.

Next, the operation of the computer system shown in FIG. 1 will be explained.

First, the operation of the CPUI and the output signal of the access control unit 4 will be explained. CPUI operations can be broadly divided into memory operations and device operations.

Memory operations include memory read and memory write, and memory read is further divided into table fetch and data read. The CPUI has a function that can distinguish whether a memory read cycle is an instruction fetch or a data read. When the CPUI performs a memory read, the access control unit 4
If the address is an address assigned to ROM2, the ROM read signal (ROMR
D), and if the address is the address assigned to RAM3, the “L” level RAM IJ
- The code signal (RAM RD ) is fixed. Furthermore, in the case of a memory read cycle or an instruction fetch, the access control unit 4 also generates an "L-level signal (FETCH)" indicating a fetch.Furthermore, when the CPUI performs a memory write, the access control unit 4 If the address is the address assigned to RAM3, “L”
” level RAM write signal (RAMWR) is generated.

Device operations include device read and device write. Normally, there are devices that can be read/written regardless of privileged/unprivileged programs, devices that can be read by non-privileged programs but read only by privileged programs, and devices that can be read by privileged programs. are allowed even to non-privileged programs, but are classified into those where writing is allowed only to privileged programs, and those where both read and write are allowed only to privileged programs.The device 9 of this embodiment is as follows. Only privileged programs are allowed to write. When the access control unit 4 writes to the CPUI or the device 9, it generates an “L” level device write signal (DEVWR). This “L° level device write signal (DEVWR) is generated regardless of whether the write is from a privileged or non-privileged program.

Next, when a device write is performed by a privileged class program, a device write signal (DEVWR) of "L level" is allowed to be supplied to the device 9, and when a device write is performed by a non-privileged class program, a device write signal (DEVWR) of "L level" is allowed to be supplied to the device 9. The operation of prohibiting (DEVWR) from being supplied to the device 9 will be described.

When a privileged class program is running, CPU instruction fetch is a memory read from ROM2, so
“L” level read signal for ROM2 (ROM
RD ) and an “L” level signal (F
ETCH) is generated from the access control unit 4. As a result, the output of the OR gate 5 becomes "L° level" and the flip-flop 7 is set to the set state.On the other hand, when a non-privileged class program is running, the CPUI instruction fetch is from the RAM 3. Since it is a memory REIT of
“L” level read signal for RAM M3 (RAM
RD) and an “L” level signal (FE) indicating instruction fetch.
TCH) is generated from the access control unit 4. At this time, the output of the OR gate 6 becomes "L" level, and the flip-flop 7 is set to the reset state. In other words, in the execution cycle after an instruction fetch, the set state of the flip-flop 7 indicates that the immediately previous instruction fetch is from the ROM.
2, that is, a privileged class program is running, and the reset state of flip-flop 7 indicates that the previous instruction fetch was from RAM3, that is, a non-privileged class program is running. It means that there is.

When the flip-flop 7 is in the set state, the “L° level write signal (DEVWR) to the device 9
is supplied to the write control power WR of the device 9 via the OR gate 8. As a result, predetermined data is written to the device 9. On the other hand, in the reset state of the flip-flop 7, the "L level write signal (DEVWR)" for the device 9 is prohibited from being supplied to the specific device 9 by the OR gate 8.
Writing to device 9 is not performed.

In this way, in this embodiment, write access to device 9 is permitted depending on whether the instruction fetch address executed by the CPU corresponds to ROM2, that is, a privileged class program, or RAM3, that is, a non-privileged class program. The prohibition is controlled by hardware. Therefore, access control such as allowing only privileged programs to access a specific device becomes possible with a simple hardware configuration without changing the CPU architecture.

In this embodiment, a case has been described in which the device to which access is permitted only to a privileged class program is a memory, but the device is not limited to the memory, but all devices accessed by the CPU are applicable.

[Effects of the Invention] As described above, according to the present invention, even when a CPU without an access right control function is used,
It is possible to implement access control that allows only privileged programs to access a specific device.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing a system configuration for realizing an access control method according to an embodiment of the present invention. 1 .=CPU, 2-ROM, 3-RAM, 4... access control section, 5, 6.8... OR gate, 7...R
-S flip-flop, 9... device.

Claims (1)

[Claims] a memory means in which a privileged class program and a non-privileged class program are stored; and a memory means in which a privileged class program and a non-privileged class program are stored; recognition means for recognizing whether the program is being operated; and generating an access permission signal when the recognition means recognizes the operation of the privileged class program, and generating an access prohibition signal when the operation of the non-privileged class program is recognized. 1. An access control method, comprising: signal generating means for generating a signal, and allowing only the privileged program to access a specific device.