US 6,282,657 B1Granted

Kernel mode protection

AssigneeSafeNet, Inc.

InventorsMichael M. Kaplan, Timothy Ober, Peter Reed

Life of this patent

Estimating the term…

Loading patent…

Abstract

A protection circuit operates in a user or kernel mode. In the kernel mode, a kernel memory is accessible only by a secure kernel. A processor is reset if a security violation occurs, such as by attempting to access kernel memory in user mode. A program fetch supervisor circuit compares addresses to a predetermined address to determine if a security violation has occurred. A data fetch supervisor circuit compares data addresses to a protected memory address range. A security violation occurs if the data address is in protected memory, which resets the processor. A method of kernel mode protection includes fetching a program opcode or data operand. If the program opcode or data operand is from kernel memory and the processor is in user mode, the processor is reset. If an opcode is fetched from user memory while in kernel mode, the processor reverts to user mode.

Claims2

Dependent claims

A controller circuit for switching between a user mode and a kernel mode in a processor comprising;

a processor;
a program counter electrically connected to the processor for monitoring program fetch addresses;
a kernel program fetch supervisor circuit having a predetermined address value stored within, the kernel program fetch supervisor circuit being electrically connected to the program counter for comparing the address in the program counter to the predetermined address value stored within the kernel program fetch supervisor circuit;
a program memory electrically connected to the program counter;
a flip-flop circuit electrically connected to the kernel program fetch supervisor circuit for switching between setting a user mode bit and a kernel mode bit;
a kernel data fetch supervisor circuit electrically connected to the processor for comparing a data fetch address to a memory address range;
a data memory electrically connected to a processor data interface for storing data;
a first AND circuit coupled to the flip-flop and the kernel data fetch supervisor circuit for activating and deactivating a violation reset signal;
and a second AND circuit coupled to the first AND circuit and the kernel program fetch supervisor circuit for activating and deactivating the violation reset signal.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 09/154,357Filed 16 Sep 1998 · us provisional application
Priority: 16 Sep 1997
Granted: 28 Aug 2001
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06F 21/72
To assure secure computing or processing of information: in cryptographic circuits
G06F 8/60
Arrangements for software engineering: software deployment
G06F 9/46
Using stored programs, i.e. using an internal store of processing equipment to receive or retain programs: multiprogramming arrangements
G06F 12/1491
By checking the subject access rights: in a hierarchical protection system, e.g. privilege levels, memory rings