Information processing apparatus and memory protection method

A memory protection method of dividing an address space of a memory into at least two protection regions, and protecting the memory from an unauthorized access to a protection region by a program, the method comprising:

• a determination step of, when the relation between the protection regions is an inclusion relation, determining that an included protection region cannot directly access an including protection region and the including protection region can directly access the included protection region;
• a first accessing step of accessing the protection region, determined to be able to be directly accessed, from a module having high reliability by a function call;
• a prohibiting step of prohibiting an access to the protection region, determined to be unable to be directly accessed, from a module having low reliability by a function call;
• wherein in the determination step, determination results of a protection region determined to be able to be directly accessed and a protection region determined to be unable to be directly accessed are stored in an access authority management table which defines a relation between the protection regions, and
• in the second accessing step, when an access is requested to the protection region determined to be unable to be directly accessed, the protection region determined to be unable to be directly accessed, which is stored in the access authority management table, is changed to a protection region which can be directly accessed, and an indirect access to the protection region determined to be unable to be directly accessed is permitted.

An information processing apparatus which divides an address space of a memory into at least two protection regions, and protects the memory from an unauthorized access to a protection region by a program, the apparatus comprising:

• a definition unit adapted to define a relation between protection regions;
• a determination unit adapted to, when the relation between the protection regions is an inclusion relation, determine that an included protection region cannot directly access an including protection region and the including protection region can directly access the included protection region;
• and
• a memory management unit adapted to permit a direct access for an access for which a direct access is determined to be possible, and prohibit a direct access for an access for which a direct access is determined to be impossible,
• wherein in the determination unit, determination results of a protection region determined to be able to be directly accessed and a protection region determined to be unable to be directly accessed are stored in an access authority management table which defines a relation between the protection regions, and
• in the memory management unit, when an access is requested to the protection region determined to be unable to be directly accessed, the protection region determined to be unable to be directly accessed, which is stored in the access authority management table, is changed to a protection region which can be directly accessed, and an indirect access to the protection region determined to be unable to be directly accessed is permitted.