JPS6074055A - Protection system for deletion data secrecy - Google Patents

Abstract

PURPOSE:To prevent illegal reading by initializing all table indications in a space area to old data indication states when assigning the space area for a data set, and setting corresponding positions to new data indications when data are updated by the subsequent writing processing of new data records. CONSTITUTION:A command analysis part 8 analyzes a command supplied from a CHU4, and actuates processing parts 9-11 respectively when the command is a purge, read, or write command. Consequently, a data purge processing part 9 sets the indication of a position CCHH corresponding to the destination in a purge control table to an ON state. A reading processing part 10 refers to said indication (ON) to set a purge bit 12a provided to a sense byte 12 to ON, and turns on a unit check signal UC to cause an interruption to the CHU4. The CHU4 accepts it and informs a CPU1 that a read inhibition state is now set by purging.

Description

TECHNICAL FIELD OF THE INVENTION The present invention relates to a data management system in a data processing device, particularly on a direct access storage device (DASD).
[Technical background] Magnetic disk A volume on a direct access storage device (hereinafter referred to as DASD), such as a DASD, typically contains multiple data sets. Records are added to and deleted from each data set as processing progresses. It may also happen that the r-dataset itself is deleted.The space created by such a deletion can be better used for another dataset requesting allocation of new space to improve the efficiency of the system. Normally, the local SD space management routine handles such space allocation.

DASD space management routines manage DASD volumes.
Space allocation control is performed according to the space information of the DSCB (7'-tase control block) stored in the Muno VT OC. Allocation of space resulting from deletion is executed by updating the DSCB, but since erasing old data takes time, it is omitted and records remain. On the other hand, the data security function does not work for the deleted area, so if another data set that has been allocated space for the deleted area reads the old data record before writing a new data record. , it is possible to know its contents.

As described above, there is a problem in that data cannot be kept sufficiently confidential, especially in computing centers that are shared by a large number of users.

[Object and structure of the invention]

The object of the present invention is that DASDyl? ! To provide a security preservation method that prevents data records of an old data set from being read when the space generated by deletion of a data set or data record on J-neem is reallocated to another data set. It is in.

Therefore, in the present invention, when deleting a re-allocated area, when allocating a space area, Rui does not erase the data record, leaves the old data record, and writes the new data record. In a method of progressively erasing old data records using DASI)yl? A barge management table is provided to display the residual status of old data records in the volume in terms of cylinder cc and track HH position, and when allocating space to a data set, all table displays at that position are set to O.
N, that is, the initial data display state is set to the old data display state, and then when data is updated by writing a new data record, by setting the corresponding position to OFF, that is, new data display, read to the old data record is performed. The access is made detectable, and if detected, the read access is prohibited.

The configuration of the present invention thereby provides a direct access storage device;
In a data processing device equipped with a direct access storage device control device, the control device includes a storage management table that displays whether or not data of the old data set remains in each predetermined area of the storage area of the direct access storage device. and means for setting an indication of a corresponding area of the purge management table means to an indication of old data when a space area resulting from deletion of a storage area of the direct access storage device is allocated to a certain data set. , when a write process is performed, means for setting the display of the purge management table means corresponding to the written area to a display with no old data; and when a read process is performed, an i4 corresponding to the area to be read; - examine the display of the management table means;
The present invention is characterized by having means for prohibiting read processing when the display indicates that old data exists, and for executing AVC+)-read processing when no old data exists.

[Embodiments of the invention]

The details of the present invention will be explained below in accordance with examples.

FIG. 1 is an overall configuration diagram of one embodiment of the present invention. In the figure, 1 is the CPU, 2 is the data management unit, 3 is the space management function, 4 is the channel device C, HU, 5 is the disk and ivy control device DPC, 6-1 to 6- are the barge management table, 7 -1 to 7- indicate disk pack devices.

Purge management tables 6-1 to 5-n correspond to disk pack devices 7-1 to 7-n, respectively. Figure 2 shows the configuration of the i4-disk management table, in which the storage area of the disk pack, that is, DASD & volume, is divided by cylinder CC and track HH.
It is now possible to manage the presence or absence of old data for each area. For example, 9 with old data is ON (
"l"), and no old data is displayed as 0FF ("0"). Note that the shaded area in FIG. 2 represents the area where old data exists.

In the CPUI, when a request to allocate a space area to a data set is made, the data management unit 2 allocates the space area using a space management function.

At that time, a special purge command provided by the present invention is issued, and the display 'eO corresponding to CCHH of the newly allocated area in the /sage management table is sent to the DPC5.
Set to N (“1”), that is, old data exists.

In addition, when the CPUI performs I10 processing to write a data record to a data set, CHU4 to DPC5
At this time, the 0DPC 5 to which the write command is issued turns off the ON display at the corresponding position in the purge management table, and changes the display to display no old data.

On the other hand, when a read command is issued to read a data record in a data set, the DPC 5
First, check the display of the corresponding position in the purge management table, and if it is ON, it means that old data is included, so reading the record from that track is prohibited, and
Read is executed only in the case of FF.

FIGS. 3(α), ψ), and (C) schematically show changes in display to explain the functions of the above-mentioned purge management table as the process progresses. FIG. 5A shows a table display of a certain data set area that has been initialized to JON (“l”) by the purge command. The same figure (h
) indicates that data record write processing has been executed and the table display has been partially changed to 0FFC60=). The same figure (C) shows that the above data set area is no longer needed.
After being returned to the r-data management unit, it is reassigned to another data set and initialized by a noyage command.

FIG. 4 shows the detailed configuration of the DPC 5, and FIG. 5 shows its control flow. In Figure 4, 8 is a command analysis section, 9 is a data purge processing section, 10 is a read processing section, 11 is a write processing section, 12 is a sense byte for status display, 12 is a purge pit, 13 is a unit check UC Represents a signal line.

The operation will be explained below according to the control flow shown in FIG.

The command analysis unit 8 outputs O data to start the processing units 9, 10, and 11 when the command is a read-related command or a write-related command given from the CHU 4, respectively.
In response to the yage command, the yage processing unit 9 selects the CCH corresponding to the access destination in the yage management table 6-1.
Set the display of the H position to ON. The read processing unit 10, in response to a read-related command, sends the purge management command 6- through the data file processing unit 9.
Refer to the CCHH display corresponding to access destination 1, and
If FF, execute read processing, if ON, sense byte 1
The purge pin 12α provided in 2 is set to ON, and the unit check signal UC is raised to interrupt the CHU4. In response to signal UC, CHU4
12 t When reading is prohibited due to reading or purging, the CPU is notified.0 The write processing unit 11, in response to the write command, issues the - SO management table 6
- Set the CCHH display corresponding to the access destination OFF to OFF. Thereby, subsequent read access to the same location will be executed without being inhibited.

〔Effect of the invention〕

As described above, according to the present invention, it is possible to securely maintain the confidentiality of deleted data records on a DASD without substantially reducing processing efficiency. The reliability of system operation can be improved.

[Brief explanation of the drawing]

Figure 1 is an overall generation diagram of one embodiment of the present invention, Figure 2 is an obtained diagram of a purge management table, and Figures 3 (a) and (b).
. (C) is a functional diagram of the purge management table, FIG. 4 is a detailed configuration diagram of the main part of this embodiment, and FIG. 5 is a control flow diagram thereof. In the figure, 4 is a channel device CHU, 5 is a disk pack control device DPC, 6-1 is a node management table, 8 is a command control unit, 9 is a data purge processing unit, IO is a read processing unit, and 11 is a write processing unit. Processing part, 12 hasens bytes, 1
2α is purge pit, 13i-1: Unit check U
Represents the C signal line. Patent applicant Fujitsu Ltd. Representative Patent Attorney Fumihiro Hase (1 other person)

Claims (1)

[Claims] In a data processing device including a direct access storage device and a control device for the direct access storage device, the control device performs purge management for displaying whether data of an old data set remains in each predetermined area of the storage area of the direct access storage device. When the table means and the space area created by the deletion of the storage area of the direct access storage device are re-allocated to a data set, the corresponding area of the motherboard management table means is displayed as having old data. means for setting the display of the purge management table means corresponding to the written area to a display of no old data when the write process is performed; i'?corresponding to the area? - a means for checking the display of the management table means and forbidding read processing if the display indicates that old data exists.