Key-based data security management
AssigneeInternational Business Machines Corporation
InventorDoyle J. McCoy
Life of this patent
Estimating the term…
Abstract
Embodiments of the present invention provide an approach for memory protection at a level of granularity above a “page” level (e.g., enhancing the protection provided by a memory key-based system). The approach further provides such a level of protection at a process or task level by associating the physical page key with a virtual key that corresponds to a particular process/task. When access to the data is requested for a particular process or task, it is determined if a protection bit for the data is set, and if the physical page keys and/or virtual keys submitted pursuant to the request match that previously stored for the data and process/task. If so, access to the data is allowed for the particular process/task.
Claims20
A computer-implemented method for managing data security, comprising:
- identifying a set of pages of data in computer storage;
- generating a physical key for each page of the set of pages, the physical key being stored in at least one table located within a kernel of an operating system of a computer system;
- generating a virtual key based on each physical key, the virtual key identifying at least one process authorized to use the data;
- generating a virtual page key signature corresponding to each virtual key;
- storing the virtual page key signature in a virtual page key register, the virtual page key register comprising part of a central processing unit of a computer system, wherein the virtual page key register is accessible in a system state by the kernel of the operating system only;
- protecting each page of the set of pages with a respective physical key and a corresponding virtual key;
- setting a data protection bit to a particular setting to indicate a protective status of the set of pages of data;
- and
- signaling a data protection exception in response to storing the virtual key in the virtual page key register while the central processing unit is in a non-system state.
A system for managing data security, comprising:
- a bus;
- a processor coupled to the bus;
- and
- a memory medium coupled to the bus, the memory medium comprising instructions to:
- identify a set of pages of data in computer storage;
- generate a physical key for each page of the set of pages, the physical key being stored in at least one table located within a kernel of an operating system of a computer system;
- generate a virtual key based on each physical key, the virtual key identifying at one process authorized to use the data;
- generate a virtual page key signature corresponding to each virtual key;
- store the virtual page key signature in a virtual page key register, the virtual page key register comprising part of a central processing unit of a computer system, wherein the virtual page key register is accessible in a system state by the kernel of the operating system only;
- protect each page of the set of pages with a respective physical key and a corresponding virtual key;
- set a data protection bit to a particular setting to indicate a protective status of the set of pages of data;
- and
- signal a data protection exception in response to storing the virtual key in the virtual page key register while the central processing unit is in a non-system state.
A computer program product for managing data security, the computer program product comprising a computer readable storage media, and program instructions stored on the computer readable storage media, to:
- identify a set of pages of data in computer storage;
- generate a physical key for each page of the set of pages, the physical key being stored in at least one table located within a kernel of an operating system of a computer system;
- generate a virtual key based on each physical key, the virtual key identifying at one process authorized to use the data;
- generate a virtual page key signature corresponding to each virtual key;
- store the virtual page key signature in a virtual page key register, the virtual page key register comprising part of a central processing unit of a computer system, wherein the virtual page key register is accessible in a system state by the kernel of the operating system only;
- protect each page of the set of pages with a respective physical key and a corresponding virtual key;
- set a data protection bit to a particular setting to indicate a protective status of the set of pages of data;
- and
- signal a data protection exception in response to storing the virtual key in the virtual page key register while the central processing unit is in a non-system state.
Dependencies are inferred from the claim text.