US 4,545,012 AGranted

Access control system for use in a digital computer system with object-based addressing and call and return operations

AssigneeData General Corporation

InventorsGerald F. Clancy, Stephen I. Schleimer, Craig J. Mundie, Steven J. Wallach, Richard G. Bratt, Edward S. Gavrin

Life of this patent

Estimating the term…

Loading patent…

Abstract

An access control system for use in a digital computer system wherein the memory system is organized into objects, a data item is locatable by specifying an object, instructions are contained in procedures, and the operations performed by the system include a call operation for suspending an execution of a procedure and commencing another execution and a return operation for terminating an execution and resuming a suspended execution. The access control system associates each procedure with a domain, i.e., a set of objects accessible to the procedure. The access control system further includes a secure stack object which is accessible only to the access control system. When a call operation commences execution of a procedure which has a different domain, the access control system responds to the call operation by storing information required to return to the current domain in the secure stack. When a return operation resumes execution of a procedure which has a different domain, the access control system responds to the call operation by using the information in the secure stack to return to the previous domain.

Claims26

Dependent claims

In a digital computer system including

(A) memory means for performing memory operations including storing and providing items of data, said items of data including instructions, and
(B) processor means connected to said memory means for performing operations in response to instructions including processing items of data
and further wherein
said instructions are contained in procedures of said data items and said processor means responds to an instruction while executing the procedure containing said instruction, and the operations performed by said processor means include
(a) a call operation suspending the execution of a current procedure and commencing the execution of another procedure and
(b) a return operation for terminating the execution of said another procedure and resuming the execution of the procedure which was suspended,
an access control system comprising:
(1 ) memory organization means operative on said memory means for organizing said memory means into objects allowing the location of said data items therein and limiting access to an object to selected procedures and thereby defining domains, each procedure having access only to objects belonging to a single domain;
(2) memory operation specifier generation means in said processor means responsive to instructions for providing a memory operation specifier for each data item processed by processor, the memory operation specifier for a given data item specifying the object in which said data item is to be located;
(3) memory operation means operative on said memory means and responsive to a memory operation specifier for performing the memory operation specified thereby only when the object specified in said memory operation specifier belongs to the domain to which the procedure containing the instruction to which said processor means is currently responding has access;
(4) a secure stack object of said objects upon which only said access control system performs said memory operations;
(5) means responsive to a call operation when said call operation commences execution of another procedure having a different domain for saving in said secure stack object information required to return to the domain of the procedure whose execution is being suspended;
and
(6) means responsive to a return operation when said return operation terminates the execution of a procedure having a different domain from that of the procedure whose execution is being resumed for obtaining said saved information from said secure stack object for the procedure whose execution is being resumed.

11 more elements

In a digital computer system including

(A) memory means for performing memory operations including storing and providing items of data, said items of data including instructions, and
(B) processor means connected to said memory means for performing operations in response to instructions including processing items of data,
an access control system comprising:
(1) memory organization means operative on said memory means for organizing said memory means into objects allowing the location of said data items therein and associating with each object at least one access control list entry data item containing a subject template specifying a selected set of subjects representing entities for which said processor means responds to said instructions;
(2) memory operation specifier generation means in said processor means responsive to instructions for providing a memory operation specifier for each data item processed by said processor, the memory operation specifier for a given data item specifying the object in which said data item is to be located and one of said memory operations;
and
(3) memory operation means operative on said memory means and responsive to a memory operation specifier for performing the memory operation specified thereby on the data item specified thereby for a current subject for which said processor means is currently responding to said instructions only when said current subject is one of said subjects in said selected set of subjects specified by the subject template in the acess control list entry for the object specified in said memory operation specifier.

4 more elements

In a digital computer system including

(A) memory means for performing memory operations including storing and providing items of data, said items of data including operations, and
(B) processor means for performing operations in response to said instructions,
a unique identifier addressing system for addressing said items of data in said memory means comprising:
(1) memory organization means for organizing said memory means into objects permanently identified by unique identifiers, each data item being associated with an object and being locatable by specifying a unique identifier identifying said associated object and an offset specifying the location of said data item in said associated object;
(2) unique identifier pointers of data items specifying locations in said objects, each unique identifier pointer containing a unique identifier and an offset;
(3) memory operation means responsive to a memory operation specifier including a logical address representing a unique identifier and an offset and a memory command specifying a memory operation for performing a memory operation specified by said memory command on the data item specified by said logical address;
(4) pointer conversion means in said processor means operating in response to said instructions and to any one of said unique identifier pointers for generating a logical address representing the same unique identifier and the same offset as is contained in said unique identifier pointer;
and
(5) means responsive to said instructions and said generated logical address for generating a memory operation specifier containing said generated logical address and providing said generated memory operation specifier to said memory operations means.

6 more elements

In a digital computer system including memory means for storing items of data including instructions and processor means connected to said memory means for performing operations in response to said instructions, means for identifying entities in said digital computer system comprising:

(1) unique identifier generation means response to the operation of said digital computer system for generating unique identifiers;
(2) memory organization means for receiving first certain unique identifiers and organizing said memory means into objects of said entities uniquely and permanently identified by said unique identifiers, each said data item being locatable by an object;
and
(3) operating system means for receiving second certain unique identifiers and associating said second certain unique identifiers with other entities.

1 more element

Dependencies are inferred from the claim text.