Patent EP0472487A2 successfully refreshed from Google Patents.
EP0472487A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Apparatus and method for controlling access to data using domains
Assignee: International Business Machines Corp
•
Filing: 1991-07-17
•
Granted: —
•
Expires: 2011-07-17
Abstract
Abstract In an object-based computer system, each object is contained in, and each task executes in, a protection domain. Domains exist at several hierarchical domain levels, (301-305) some levels having multiple discrete domains (320-322 ; 340-342), while others have one common domain. A task may access an object if the domain in which the task is executing is the same as the domain containing the object, or if the domain in which it is executing occupies a higher hierarchical domain level than the domain containing the object. Each object includes a domain attribute, which is a numerical value defining the domain in which it is contained. The domain attribute of the currently executing task is stored in a domain register. When an attempt is made to access data within an object, the domain attribute of the object is compared with the domain attribute stored in the domain register. If the access conditions are met, access is permitted.
Inventors
- 👤 Steven Jay Munroe
- 👤 James Gregory Ranweiler
- 👤 George David Timms, Jr.
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-31 21:30
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/46; G06F9/468; G06F12/00; G06F12/14; G06F12/1458; G06F12/1491
Claims Analysis
Total Claims: 13
Claim 1
Independent Claim
191 words
A computer system having data contained in a plurality of objects, comprising: means for storing said plurality of objects in said computer system; means for executing a plurality of tasks requiring access to data contained in said objects; a plurality of hierarchical protection domain levels; a plurality of protection domains, each of said protection domains occupying one of said hierarchical levels, wherein at least two of said protection domains occupy the same hierarchical level, wherein each of said tasks executing in said system is executing in one of said protection domains and each object stored in said system is contained in one of said protection domains; and means for determining whether a task may access data contained in an object, wherein said means determines that the task may access the data if the protection domain in which the task is executing is the domain containing the object, or if the protection domain in which the task is executing occupies a higher hierarchical level than the domain containing the object; and means, responsive to said means for determining whether a task may access data contained in an object, for accessing said data.
Claim 2
Dependent Claim
69 words
The computer system of claim 1, wherein said means for determining whether a task may access data contained in an object further comprises: means for associating a domain attribute with each domain; and means for comparing the domain attribute associated with the domain in which the task is executing with the domain attribute associated with the domain containing the object to determine whether the task may access the data.
Claim 3
Dependent Claim
40 words
The computer system of claim 1, wherein each object stored in said computer system contains a domain attribute identifying a domain, and wherein the protection domain containing said object is defined to be the domain identified by said domain attribute.
Claim 4
Dependent Claim
68 words
The computer system of claim 3, wherein each task executing in said computer system is associated with a domain attribute identifying a domain, and wherein said means for determining whether a task may access data contained in an object further comprises means for comparing the domain attribute associated with the task with the domain attribute contained in the object to determine whether the task may access the data.
Claim 5
Dependent Claim
23 words
The computer system of claim 4, further comprising means for changing the domain attribute associated with a task during execution of said task.
Claim 6
Dependent Claim
64 words
The computer system of claim 5, wherein said means for changing the domain attribute associated with a task comprises: a plurality of procedures contained in objects; means for associating an execution domain attribute with each of said procedures; and means for substituting the execution domain attribute associated with a procedure for the domain attribute associated with a task when said task calls said procedure.
Claim 7
Dependent Claim
119 words
The computer system of claim 1, wherein said computer system has an address space divisible into segments, each segment comprising a plurality of address locations; wherein each said object comprises one or more said segments; wherein said means for determining whether a task may access data contained in an object makes such determination in response to a request to access a first data location within a segment contained in said object; and wherein said means for accessing data contained in an object comprises means for directly accessing data contained in a second data location within said segment subsequent to accessing said first data location without said means for determining whether a task may access data contained in an object.
Claim 8
Dependent Claim
22 words
The computer system of claim 1, wherein the lowest of said hierarchical protection domain levels is occupied by a single protection domain.
Claim 9
Dependent Claim
25 words
The computer system of claim 1, wherein at least two of said hierarchical protection domain levels are each occupied by more than one protection domain.
Claim 10
Independent Claim
163 words
A method for controlling access to data contained in objects stored in a computer system by tasks executing in said system, comprising the steps of: defining a plurality of hierarchical protection domain levels; defining a plurality of protection domains, each of said protection domains occupying one of said hierarchical levels, wherein at least two of said protection domains occupy the same hierarchical level; associating a protection domain with each object stored in said computer system; associating a protection domain with each task executing in said system; determining that a task executing in said system may access data contained in an object stored in said system if the protection domain associated with the task is the same as the protection domain associated with the object, or if the protection domain associated with the task occupies a higher hierarchical level than the protection domain associated with the object; and accessing said data in response to said step of determining that a task may access data.
Claim 11
Dependent Claim
85 words
The method for controlling access to data contained in objects of claim 10, wherein said step of associating a protection domain with each object associates a domain attribute with each object; wherein said step of associating a protection domain with each task associates a domain attribute with each task; and wherein said step of determining that a task may access data contained in an object comprises the step of comparing the domain attribute associated with the task with the domain attribute associated with the object.
Claim 12
Dependent Claim
38 words
The method for controlling access to data contained in objects of claim 10, wherein said step of defining a plurality of protection domains defines only one protection domain to occupy the lowest of said hierarchical protection domain levels.
Claim 13
Dependent Claim
58 words
The method for controlling access to data contained in objects of claim 10, wherein said step of defining a plurality of protection domains defines a first and a second protection domain to occupy one of said hierarchical protection domain levels, and defines a third and a fourth protection domain to occupy another of said hierarchical protection domain levels.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.