Arrangement for protecting data in a computer system memory module against unauthorised access

The subject of the invention is a data protection system in a computer system memory block against unauthorized access, which in particular protects code and data contained in a memory block against false write operations as a result of executing program code from another memory area, even if these different memory blocks are in the same virtual address space.

Memory protection keys for computer system memory blocks are described in US Patent Nos. 3,576,544, 4 093 987. Memory protection keys have been used in commercial IBM System S / 360, S / 370 and S / 390 systems and systems compatible with them.

The architecture of the IBM S / 390 system allows the use of memory keys 0 - 15 and access keys 0 - 15, as described in the Principles of Operation of the S / 390 architecture system (document number SA22-7201-00), published by the IBM corporation. In current systems, 0-15 keys provide two levels of protection, one for supervisory class keys (implemented with the 0 key) and the other for user class keys (implemented with the 1-15 key). Supervisor key 0 allows access to data in any memory block (regardless of the allocated memory key). The supervisory access key (from keys 1-15) allows access to the memory block only if there is a match between the access key (used by the access request program) and the memory block key against which the access operation is being performed. For each block (page) of 4KB memory in the main memory chip of the S / 360, S / 370 and S / 390 system, there is a memory key. Each operation of access to the system's main memory checks the security key with the access key provided by each program requesting access. The access key is usually provided based on the access key field in the program status word (PSW). The access key is compared with the memory protection key for the currently addressed page in system memory using a rather complex, hardware-enforced rule set to check if the keys match. These rules use the download operation protection bit (FP) in each memory key, the save operations do not depend on the FP bit setting, and the save operations for unattended access keys 1-15 require access key and protection key compatibility. In the case of a download request, the FP bit determines whether compliance is needed to allow access for non-supervisory access keys 1-15. If the Fp bit is zero, no compatibility is required to perform the download operation, regardless of the value of the access key and memory key. However, if the bit FP is equal to one, then key compatibility is required to enable the download operation for unattended keys 1-15. For supervisory access key 0, access operation is possible regardless of whether it is compatible with any memory key 1-15.

Memory protection with access keys found on systems using IBM S / 390 architecture has a two-level protection structure consisting of a supervisory level (key 0) and an unattended level (keys 1-15). Supervisory programs have access to memory blocks allocated to supervisory programs, but supervisory programs do not have access to memory blocks allocated to supervisory programs. This key protection creates a critical path associated with every memory access in the system because it is performed for every memory access. So the key protection system in the S / 390 system (and in its predecessors S / 360 and S / 370) works in parallel, overlapping with other operations performed during memory access, so as not to increase the access time to the memory block .

Protection keys secure access to real memory in a computer system and allow addressing protection in comparison with other protection methods that occur

170 547 on S / 390 systems, such as virtual addressing and virtual address space, to extend the scope of protection compared to memory keys. Virtual addressing maps the address in the program to any address in the page memory that occurs_in physical memory in such a way that the real physical address is variable and unknown to the user using the computer system. If a program executing in one address space cannot access another address space, then the data and programs in that address space are protected against such program. Memory keys are used to gain protection within an address space in relation to programs that have access to that space but do not have permission over some of the data in that space.

He is also known from an article by P. Bunce and others entitled System integrity in MIL = STD-1750A real-time environments in ELECTRO 86 of December 1986, Los Angeles, USA, a data protection method that allows three levels of protection: systemic, normal and explicit. The system domain has access to itself and to other domains, normal domains can have access to each other and the explicit domain, and the explicit domain can only access itself.

The essence of the data protection system in the computer system memory block against unauthorized access according to the invention comprising the access key comparison system with the supervisory key, the access key comparison system with the memory key, the system comparison of the memory key with the public key and the system access key comparison with the public key a signal is given to the address of the data unit that is to have access to the data block, the access key signal assigned to the program requesting access to the data block and the download / write signal identifying the access method is that it contains, connected to the output of the access key comparison system with the supervisory key, with the control key output signal, the system of the comparison of the access key with the memory key, with the output signal of compliance, the system of comparing the memory key with the public key, with an explicit key output signal and a public key comparison system, with an explicit access key output signal, the first set of AND gateways allowing access to the addressed data block and sending the first signal bus, access permission to the requesting computer system unit when the key signal is present control at the OR output, presence of a compliance signal at the OR output, the presence of an explicit memory key signal and the lack of an explicit access key signal, compliance signal and control key signal at the output of the first AND gate, the occurrence of a download request signal and an explicit access key signal, and the lack of compliance signal and control key signal at the output of the second AND gate when the explicit key is unlocked . or there is a pickup request signal and an explicit access key signal of a non-compliance signal and a control key signal at the output of the third AND gate when the explicit key is locked, wherein the OR system and the first, second and third AND gate are connected between the comparison system outputs and the first output bus.

The protection circuit includes a fourth AND gate connected between the comparison circuits outputs and the first signal output bus allowing access to the addressed data block and sending the first signal bus access access to the requesting computer system unit, when there is a download request signal and no explicit memory key signal signal public access key, compliance signal and control key signal at the output of the fourth AND gate when unlocking the explicit key.

The data protection system in the computer system memory block against unauthorized access according to the invention also includes a second AND gate group of access blocking of the addressed data block and sending a second signal output bus access exception to the requesting computer system unit in the presence of the download protection signal, the second set of gates being connected between the comparator outputs and the other output bus.

170 547

The protection circuit then includes the fifth, sixth and seventh ANd gates enabled between the comparison circuit outputs and the second signal output bus access exception to the requesting computer system unit in the presence of the memory request signal and the absence of an explicit memory key signal, an explicit access key signal, a compliance signal and a signal control key at the output of the fifth AND gate when unlocking the explicit key, the presence of a memory request signal and an explicit access key signal, and the lack of compliance signal and control key signal at the output of the sixth AND gate when unlocking the explicit key, or the occurrence of a memory request signal and an explicit access key signal and the lack of compliance signal and control key signal at the output of the seventh AND gate when an explicit key is locked.

In the present invention, the user with any intermediate key has access to any public key storage block. However, no public key user can perform write operations (or fetch if fetch protection is enabled) into a memory block protected by a supervisory key or intermediate memory block keys.

The invention in an embodiment is shown in the drawing, in which Fig. 1 shows a general diagram of the computer system, Fig. 2 - conventional memory protection key, Fig. 3 - access key and P bit in the program status word, Fig. 4 - access key in general purpose register, used by several different types of instructions, Fig. 5 - access key in the operation request block, used for I / O operations, fig. 6 - PSW key mask bits in the control register, Fig. 7 - entry point key and key mask field used in address space control, Fig. 8 - public memory key mode control field, Fig. 9 - flowchart and Fig. 10 - state chart relating to the data protection system according to the invention shown in Figure 11 in a schematic diagram.

Figure 1 shows a general diagram of a computer system in which the protection system according to the invention is used. The system includes a set of central processing units, CP-O to CP-N, and an assembly of I / O devices, I / O to I / OK, with subchannels, control units and channels. CP and I / O units request access to the main memory controller 20 managing the download and storage of data units in the main memory (MS) 21. Main memory 21 contains a set of DRAM metrics for storing MS data units. Each access request contains the absolute address of the data unit, downloaded and stored in the main memory 21. CP units generate logical addresses, which are virtual addresses, but can also be real addresses, according to the S / 390 architecture. Each virtual address, generated by any CP unit, is translated into an absolute address, sent along with the main storage access request 21, according to the requesting system's access key. Each absolute address requested has an older part representing the address of a 4 kilobyte (KB) block (here called page) in main storage 21 containing the desired data unit. The security key matrix 22 consists of one or more DRAMs containing memory protection keys of the type specified in the S / 390 architecture. The keys in the key matrix 22 are associated with the respective data memory pages in main memory 21 based on a one-to-one relationship. When the main memory 21 receives the address of the data unit, the key matrix 22 simultaneously receives the address of the data unit page to determine the memory protection key and the key matrix 22 associated with the data unit to which access is made in the main memory 21. Such as addressing the main memory 21 and the matrix of keys 22 is known from existing solutions.

Figure 2 shows the form of each of the memory protection keys in a protection key checking system 23 (defined in S / 390 architecture). Each memory protection key takes a byte of memory in the key matrix 22 and contains several fields, including a four-bit ACC field, often referred to as a memory protection key, although more precisely the entire byte is a memory protection key. The remaining fields in the memory protection key are single-bit fields: FP (download protection), R (command) and C (change). The content of the ACC key field in the memory protection key is compared with the four-bit access key provided by the program requesting access to the main memory 21. The security key checking system 23 receives the memory protection key taken from the key matrix 22. The checking system 23 controls the downloaded key

170 547 memory protection in relation to the access key associated with the current request made by CP units or I / O units. The access key is obtained from the control element defined in the known S / 390 architecture. The access key is provided by the respective CP units or I / O units requesting main storage access operations 21. Figures 3, 4, 5 show different sources of access keys. The specific source is selected by CP units or I / O units requesting access to main storage 21.

Figure 3 shows the PSW program status word as the access key source for each CPO-N unit. The word PSW in the appropriate CP unit is the source of the access key for most orders executed in the CP unit, requesting access to main memory 21. Several CP unit instructions do not use the PSW word as the only source of the access key, but also the general purpose register (GR key) in which the access key is in bit positions 24-27, as shown in Fig. 4. These few commands are defined in the S / 390 architecture as: load to first, load to second, load with key, load with target key and load with source key.

The field P shown in Fig. 3 in the word PSW in bit position 15 controls whether the corresponding CP unit is operating in a problem or supervisory state. In the problem state (bit 15 in the word PSW is equal to 1) the key mask of the word PSW in the mask CR3 (Fig. 6) is used to determine whether the requester is authorized to use the access key specified in the GR. In the supervisory state, the GR key is used.

Figure 5 shows the access key in the ORB request request block used by most I / O device access requests (from any I / O device: from I / OO to I / OK) as the source of the main memory access key 21. The ORB is the control block in MS, obtained using the subchannel start command, which launches any I / O device in the S / 390 architecture. Bit positions 0-3 in the ORB block contain the access key.

The command to call the program in the S / 390 architecture uses the access key obtained on the basis of the ETE entry point table, in which the access key is called EK (access key), as shown in Figure 7. The use of the EK access key is done using the PSW key mask field control register CR 3 as shown in figure 6. The resulting mask can be a modification of the mask field in the PSW key in the CR 3 control register, modified according to the authorization key mask field and the input key mask field, according to the M field in the ETE table shown in Fig. 7, as specified in the S / 390 architecture .

The operation of the data protection system is determined by the field setting of the PSK public memory protection key mode, shown in figure 8, as the position of bit 7 in the CR 0 register (referred to as CR 0.7 bit). System operation is triggered if the CR 0.7 bit is set to 1, and conventional key operation is obtained with the CR 0.7 bit set to 0.

Figure 9 shows a flowchart pertaining to the data protection system for each memory access request from any CP unit or I / O device if the CR 0.7 bit is set to state 1 to enable the PSK Public Memory Protection Key Mode field to be set.

Step 31 of Figure 9 is performed after a memory request after priority has been obtained for execution by the main memory controller 20 of Figure 1 in a typical manner. If it is determined in step 31 that the obtained access key is a supervisory key (key 0), then the YES path to step 32 is performed to terminate access, and in Fig. 1 the access permission signal is provided to the main memory 21 by the security key checking system 23 to allow the main memory 21 to complete the requested download or access to write to that memory. If it is determined in step 31 that the obtained access key is not a supervisory key, then the path to step 33 is executed.

In step 33, the access key is tested to see if it is equal to the ACC field in the memory protection key (Fig. 2). If so, go to step 32 to complete the download or save. However, if the access key is not equal to the security key, then proceed to step 34, in which the state of the CR 0.7 mode bit is examined to determine whether it is in PSK or conventional mode. If the CR 0.7 bit is at 0 then it means that the PSK mode is not currently active and you proceed to step 38. Then in step 38

170 547 examines the request to determine if it is a download request or not. A negative result in step 38 indicates that the access request is for write. If a write request is found, it is not allowed to complete it, because it is only possible when the access key and the memory key were found to be compatible in step 33, resulting in a path along the YES path from steps 33 to 32. However, from step 33, the exit follows the path NO, after the access key has been found to be incompatible with the memory protection key, prohibiting the write request to be completed. If no download request was found in step 38, then exit NO to step 41, in which an access exception is generated to indicate that this write request will not be completed. The access permission line in Fig. 1 is not activated, which prevents a write request in the main memory 21.

However, if in step 34 it was found that the CR 0.7 bit is in state 1, it means that PSK mode exists and a YES path to step 36 is performed, in which it is checked whether the access key is in the public class by checking it for any values ​​equal code belonging to the public class. The YES path to step 38 is performed if the access key equals any public key. For example, 9 or 15 may be selected as individual keys in the public class, or the public multiple key class may contain keys 9, 10 and 15.

However, if the access key is not equal to the requested public class key, then the path NO from steps 36 to 37 is performed. In step 37, it is determined whether the current access key is a public key by checking that it is equal to any of the public class keys. If the access key is a public key, then the YES path from steps 37 to 32 is performed to complete the download or access to write to main storage 21. However, if in step 37 it is determined that the access key is not a public key, then step 38 is performed, in which it is checked whether the current request is a download or not (i.e. it is a write to the memory), because the state of the FP bit allows access, if it is a download request.

As explained previously, the path NOT from steps 38 to 41 is performed if it is found to be a write request (because writing is prohibited if in the previous step 33 it was found that the access key does not match the memory key). The transition from step 38 to 42 is via the YES path if a download request has been found. In step 42, the state of the FP field in the currently addressed memory protection key is examined to determine whether download protection is enabled (FP = 1), in which case the download is prohibited and the path YES to step 41 is carried out, which throws an access exception , indicating that a prohibited action is being performed, which interrupts and suspends the execution of the current order. If in step 42 it is determined that the download protection is disabled (FP = 0), it means that the download is possible and the path NO proceeds to step 32.

Figure 10 shows the hierarchy of three key classes, classes I, II and III, in which I is the highest class and the lowest III, with access control restricted in order of classes I, II, III. Class I is a supervisory class, class II is an intermediate class and class III is a public class. Each class contains one or more security keys. For example, in a system where the security key is specified using the four-bit security key field (in which the security keys are specified as keys 0-15), supervisor class I can be arbitrarily represented by key 0. Public class III can be arbitrarily represented by key 9. Intermediate class II is represented by the remaining keys 1-8, 10-15.

Fig. 10 shows that the class has access to itself, as indicated by the arrows going out and entering the same circle; this means that the condition of equality in the operation of comparing the access key with the memory key is met. Class I has access to any other class, intermediate class II or public class III. The only class to which intermediate class II has access is public class III. The use of a class III public key does not allow access to another class, and the public keys are subjected to a test of compliance of the access key with the memory key before one of the public class keys can get into the memory block allocated to another public class memory key.

The following diagram illustrates the download and storage operations resulting from the use of any memory keys and access keys using the three states shown in Fig. 10, using the control methods in Fig. 9. Setting the protection bit

170 547 downloads (FP) in the memory key control the download operation, where F is shown with an asterisk (*), i.e. F *, as follows:

Access control table for three classes

<td colspan="2"></td><td colspan="3">Memory Protection Key</td>

<td colspan="2"></td><td>class I</td><td>class II</td><td>class III</td>

<td>kd</td><td>class I</td><td>F / S</td><td>F / S</td><td>F / S</td>

<td>lo</td><td></td><td></td><td></td><td></td>

<td>us</td><td>class II</td><td>p *</td><td>F * / S *</td><td>F / S</td>

<td>ct</td><td></td><td></td><td></td><td></td>

<td>with ę</td><td>class III</td><td>p *</td><td>p *</td><td>F * / S *</td>

<td>P</td><td></td><td></td><td></td><td></td>

<td>at</td><td></td><td></td><td></td><td></td>

Legend:

F / S = permission to download or save to memory (FP me setting has none) _t impact)

F = download operation only possible if. a / FP = 0 or 'b / access key = memory key if FP = 1.

S = write operation possible only when: access key = memory key (FP me setting has no effect)

Figure 11 is a schematic diagram of the data protection system according to the invention, performing key checking and overlapping key checking operations with main memory access operation 21. This means that the data protection system can work simultaneously with the DRAM access operation in main memory 21 and, that it can generate an output access allowed or access exception before this memory completes the download or write operation for the requested data unit.

The data protection arrangement in the computer system's memory block against unauthorized access includes a key comparison key 131 with a supervisory key, a key comparison key 133 with a memory key, a key 137 key comparison with a public key and a key 136 key comparison with the public key, wherein the signal of the address of the data unit which is to have access to the data block is fed to the inputs of these systems, an access key signal associated with the program requesting access to the data block and a download / write signal identifying the access method. To the output of the supervisor key comparison system 131, with the control key output signal, the access key comparison system 133 with the memory key, with the compliance signal output, the 137 comparison key of the public key memory key, with the explicit key output signal, and the 136 key comparison system public key access, with the explicit access key output signal, the first AND 51,52,53 gate set is attached, 54 allow access to the addressed data block and send the first signal bus 71 signal allow access to the requesting computer system unit when the control key signal is present at the OR 57 output, there is a compliance signal at the OR 57 output, the presence of an explicit memory key signal and no signal explicit access key, compliance signal and control key signal at the output of the first AND 55 gate, the occurrence of a download request signal and an explicit access key signal, and the lack of compliance signal and control key signal at the output of the second gate ANd 65 when the explicit key is unlocked, or the occurrence of a download request signal and an explicit access key signal no compliance signal and control key signal at the output of the third AND gate 63 when blocking an explicit key. OR 57 and the first, second and third AND gates 55,65, 63 are connected between the outputs of the comparison systems 131, 133, 137, 136 and the first output bus 71.

The system includes the fourth AND 68 gateway connected between the outputs of the comparison systems 131, 133, 137, 136 and the first output bus 71 of the access permission signal

170 547 addressed data block and sending the first output bus 71 signal permission to access the requesting computer system unit when there is a download request signal and no explicit memory key signal, explicit access key signal, compliance signal and control key signal at the output of the fourth AND 68 gate unlocking the public key.

In addition, the data protection system includes a second set of AND 61, 62, 64, 66, 67, 69 gate locks for addressing the addressed data block and sending a second signal bus 72 with an exception except for accessing the requesting computer system unit when a pickup signal is present, with the second set AND 61, 62, 64, 66, 67, 69 gates are connected between the comparator outputs 131, 133, 137, 136 and the second output bus 72.

The system then includes the fifth, sixth and seventh AND gates 69, 66, 61 connected between the outputs of the comparison circuits 131, 133, 137, 136 and the second output bus 72 signal access exception to the requesting computer system unit in the presence of a memory request signal and no explicit signal memory key, explicit access key signal, compliance signal and control key signal at the output of the fifth AND 69 gate when unlocking the explicit key, the presence of a memory request signal and an explicit access key signal, and a lack of compliance signal and control key signal at the output of the sixth AND 66 gate when unlocking the secret key, or the presence of a memory request signal and an explicit access key signal, and a lack of compliance signal and control key signal at the output of the seventh AND gate 61 when an explicit key is locked.

The four comparison systems 131, 133, 137 and 136 perform the comparison operations shown in Fig. 9 by steps 31, 33, 37 and 36, simultaneously (in parallel) performing the comparison operations of Fig. 11. On the first output bus 71 there is an access permission signal , shown in Fig. 1. An access exception signal is shown on the second output bus 72, shown in Fig. 1. The same functions are shown in Fig. 9 by steps 32 and 41.

Figure 11 shows systems with positive logic, but it is obvious that any number of AND, OR, INVERT functors can be used to implement the system shown there. Each of the comparison systems 131, 133, 137 and 136 performs the comparison operations shown in Fig. 9, respectively. Fig. 11 shows them with the complementary outputs 1 and 0. Output 1 is active when the condition of Fig. 9 the YES condition is required and output 0 is active when the NO condition is required to meet the condition of Fig. 9.

The corresponding relations between the operations of Fig. 9 and Fig. 11 are as follows: the signal from OR 57 corresponds to the path YES from step 31 or 33 from Fig. 11. AND gate 55 corresponds to the path NIE from step 37. Signal from any AND gate 61 , 64 and 67 corresponds to the path NIE from step 38. The signal from any AND gate 62, 64 and 67 corresponds to the path YES from step 42. The signal from any AND gate 63, 65 and 68 corresponds to the path NIE from step 42.

In Fig. 11, a logical sum is implemented on the first bus 71 on the signals of the OR 57 system and AND gates 63, 65, 68 and 55 (of which only one system / gate provides the bus signal at a time to generate the output signal access completed. On the second output bus 72, a logical sum is implemented on the wire of signals from AND gates 6162,64,66 and 69 (of which only one gate supplies the bus signal at a given time in order to generate an access exception output signal.

The subject of the invention has been presented in a typical embodiment, but it will be understood by those skilled in the art that various changes of detail can be made therein without violating the idea, scope and essence of the invention.

170 547

170 547

<td>MEMORY KEY (FROM 4 KB BLOCK)</td><td>ACC</td><td>FP</td><td>R</td><td>C</td><td></td><td>FIG.2</td>

<td></td><td colspan="5"> 0-----3. 4,5,6,7</td><td></td>

PSW

<td></td><td>KEY ACCESS</td><td></td><td>P</td><td></td>

8----11 15

FIG.3

GR

KEY

ACCESS

24---27 31

ORB

CR3

KEY

ACCESS

FIG.5

PSW KEY MASK MASKS

6 discloses

FIG.7

EEO

AUTHORIZATION KEY MASK

HOOD

M &amp; A

<td></td><td>M</td><td></td><td>&lt;ARCH AND iĘjSCIA</td>

<td></td><td></td><td></td><td>EXT 1</td>

96------111 132 136--139 255

CRO

MODE

PSK

FIG. 8

170 547

Fl G 9

MEMORY ACCESS REQUEST (CP OR 1/0) f YES

3). IS THE ACCESS KEY A SUPERVISORY KEY? NO YES

3-IS THE ACCESS KEY EQUAL OF THE ACC FIELD IN THE MEMORY KEY?^-

NO

NO _, '

-j4-DO CRO.7 = 1?

YES

YES ,,

-36. IS THE ACCESS KEY A CLASS?

PUBLIC?

NO. IS THE ACCESS KEY A MEMORY KEY IN A PUBLIC CLASS?

NO

YES 32. ACCESS _ ACCESS (EXIT

COMBINATION OF DOWNLOAD OR ENTRY)

<img file="PL170547B1_D0001.tif" />

38. Does the Pick task?

NO

YES. GENERATION EXCEPT ACCESS

YES

42. IF FP = 1 IN THE MEMORY KEY? - (PROTECTED DOWNLOAD)

FIG 1 0

<img file="PL170547B1_D0002.tif" />

170 547 ο

OCQ ω&gt; &lt;

6η

OHW

GZS &lt;2 3 I — ICQ ZOH HC ^ OU fe? OtfH

<img file="PL170547B1_D0003.tif" />

BEEPING EXCEPTION # B§o^E?/about^D° ^ giving cp

170 547

FIG. 1

<img file="PL170547B1_D0004.tif" />

Department of Publications of the Republic of Poland Circulation 90 copies

Price PLN 4.00