US5023773A — Authorization for selective program access to dat…

Claim 1

Independent Claim 551 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each instruction having an operand field, and said main memory being allocated into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a plurality of access registers, each access register for containing a number having the value of an access-list-entry token (ALET) designating one of said address spaces for associating each access register and its ALET with one of said address spaces, said access registers being addressable by the contents of the operand field of a program instruction; access-register translation (ART) means in said central processor having an input for receiving the ALET of the access register designated by the contents of the operand field of the instruction and, responsive thereto, providing an address into the address space associated with said ALET; address translating means in said central processor having an input for receiving the contents of the operand field of the program instruction being executed by said central processor, and an input for receiving the address from said ART means, said address translating means for translating the contents of the operand field to a logical address and combining said logical address with the address from the ART means to form a real address in the address space designated by the ALET; said ART means further including authorizing means for authorizing data access to the address space designated by the ALET by the program being executed by said central processor; an access list having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces, said access list being associated with selected programs; an access-list entry number (ALEN) in each ALET, said ALEN designating one of said access-list entries; a P bit in each of said access-list entries, said P bit being assigned a first value when the address space associated with the access-list entry is open to all of said selected programs, and being assigned a second value when the address space associated with the access-list entry is open to only authorized programs; first access allowing means in said ART for determining the value assigned to said P bit, said first access allowing means allowing continued execution of the instruction for allowing access to said designated address space by said program being executed by said central processor when said P bit has its first value; a control register for storing an extended authorization index (EAX) value for said program being run by said operating system; an access list extended authorization index (ALEAX) field in each of said access-list entries for storing an ALEAX value; and second access allowing means in said ART means for comparing the EAX value with an ALEAX when said P bit has its second value, said second access allowing means allowing access to said designated address space by said program being executed by said central processor when said EAX value is equal to the ALEAX value of the access-list entry designated by the ALEN of the ALET in the access register addressed by the contents of said operand field.

Claim 2

Dependent Claim 551 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each instruction having an operand field, and said main memory being allocated into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a plurality of access registers, each access register for containing a number having the value of an access-list-entry token (ALET) designating one of said address spaces for associating each access register and its ALET with one of said address spaces, said access registers being addressable by the contents of the operand field of a program instruction; access-register translation (ART) means in said central processor having an input for receiving the ALET of the access register designated by the contents of the operand field of the instruction and, responsive thereto, providing an address into the address space associated with said ALET; address translating means in said central processor having an input for receiving the contents of the operand field of the program instruction being executed by said central processor, and an input for receiving the address from said ART means, said address translating means for translating the contents of the operand field to a logical address and combining said logical address with the address from the ART means to form a real address in the address space designated by the ALET; said ART means further including authorizing means for authorizing data access to the address space designated by the ALET by the program being executed by said central processor; an access list having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces, said access list being associated with selected programs; an access-list entry number (ALEN) in each ALET, said ALEN designating one of said access-list entries; a P bit in each of said access-list entries, said P bit being assigned a first value when the address space associated with the access-list entry is open to all of said selected programs, and being assigned a second value when the address space associated with the access-list entry is open to only authorized programs; first access allowing means in said ART for determining the value assigned to said P bit, said first access allowing means allowing continued execution of the instruction for allowing access to said designated address space by said program being executed by said central processor when said P bit has its first value; a control register for storing an extended authorization index (EAX) value for said program being run by said operating system; an access list extended authorization index (ALEAX) field in each of said access-list entries for storing an ALEAX value; and second access allowing means in said ART means for comparing the EAX value with an ALEAX when said P bit has its second value, said second access allowing means allowing access to said designated address space by said program being executed by said central processor when said EAX value is equal to the ALEAX value of the access-list entry designated by the ALEN of the ALET in the access register addressed by the contents of said operand field.

Claim 3

Dependent Claim 175 words

The program authorization mechanism of claim 1 further comprising: an authority table (AT) in said main memory associated with each address space, each AT having an AT entry for each EAX in use; an S bit in each AT entry, said S bit being assigned a first value when the EAX of that AT entry is authorized access to the address space associated with that AT, and being assigned a second value when the EAX of that AT entry is not authorized access to the address space associated with that AT; and third access allowing means in said ART for examining the value of the S bit when said P bit has its second value and said EAX is not equal to said ALEAX, said third access allowing means allowing access to said designated address space by said program being executed by said central processor when the S bit for the AT entry of the AT associated with the designated address space for the EAX value stored in said control register has said first value.

Claim 4

Dependent Claim 26 words

The program authorization mechanism of claim 2 further comprising: PROGRAM CALL means in said operating system for changing the EAX value stored in said control register.

Claim 5

Dependent Claim 56 words

The program authorization mechanism of claim 3 further comprising: saving means in said main memory for saving the EAX value stored in said control register before said EAX value is changed by said PROGRAM CALL means; and RETURN means in said operating system for restoring said EAX value from said saving means to said control register.

Claim 6

Dependent Claim 136 words

The program authorization mechanism of claim 1 further comprising: a plurality of ASN-second-table entries, each ASN-second table entry (ASTE) corresponding to a selected address space; an ASTE address in each access-list entry for associating the access-list entry with the ASTE; an ASTE sequence number (ASTESN) in each ASTE, said ASTESN having a selected value; an ASTESN in each access-list entry whose value is set to the value of the ASTESN in the ASTE at the time the access-list entry was associated with the ASTE; and authority withdrawal means in said ART means for comparing the value of the ASTESN of the access-list entry to the value of the ASTESN of its corresponding ASTE, and preventing the further execution by said central processor of a program which otherwise has data access when said values do not match.

Claim 7

Dependent Claim 378 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each of said instructions having an operand field, said main memory being allowed into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a control register for storing an extended authorization index (EAX) value for the program being executed by said central processor; access-list means having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling access to the address space associated with each access-list entry; access-register translation (ART) means in said central processor having an address space locating means including an input for receiving the contents of said instruction operand field, said address space locating means for locating an entry in said access-list means corresponding to the contents of said instruction operand field thereby locating its associated address space, said ART means further having a first access allowing means for comparing the EAX value in said control register with the ALEAX of the located entry in said access-list, said first allowing means allowing continued execution of the program being executed, thereby allowing access to the address space associated with said located access-list entry when the EAX in said control register is equal to said ALEAX of said located access-list entry; an entry table means having entry-table entries in said main memory for storing entry data, each entry-table entry being associated with one of said programs; PROGRAM CALL means for changing said EAX value to a changed EAX value such that the program being executed by said central processor is run under said changed EAX value, said PROGRAM CALL means transferring control from a calling program to a called program; and authorization changing means in said PROGRAM CALL means and connected to said entry-table entries, said authorization changing means for changing the authorization of said called program called by said calling program responsive to entry data in the entry-table entry associated with said called program.

Claim 8

Dependent Claim 378 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each of said instructions having an operand field, said main memory being allowed into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a control register for storing an extended authorization index (EAX) value for the program being executed by said central processor; access-list means having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling access to the address space associated with each access-list entry; access-register translation (ART) means in said central processor having an address space locating means including an input for receiving the contents of said instruction operand field, said address space locating means for locating an entry in said access-list means corresponding to the contents of said instruction operand field thereby locating its associated address space, said ART means further having a first access allowing means for comparing the EAX value in said control register with the ALEAX of the located entry in said access-list, said first allowing means allowing continued execution of the program being executed, thereby allowing access to the address space associated with said located access-list entry when the EAX in said control register is equal to said ALEAX of said located access-list entry; an entry table means having entry-table entries in said main memory for storing entry data, each entry-table entry being associated with one of said programs; PROGRAM CALL means for changing said EAX value to a changed EAX value such that the program being executed by said central processor is run under said changed EAX value, said PROGRAM CALL means transferring control from a calling program to a called program; and authorization changing means in said PROGRAM CALL means and connected to said entry-table entries, said authorization changing means for changing the authorization of said called program called by said calling program responsive to entry data in the entry-table entry associated with said called program.

Claim 9

Dependent Claim 121 words

The program authorization mechanism of claim 6 wherein each of said entry-table entries includes means for storing an entry EAX (EEAX) in said entry data; and said program authorization mechanism further comprises: EAX changing means in said authorization changing means for replacing said EAX value in said control register with said EEAX in the entry-table entry associated with said called program; and extended-authorization-index control means in the entry-table entry data associated with said called program, said extended-authorization-index control means controlling said EAX changing means and having a first value if said EAX changing means is to replace said EAX with said EEAX and having a second value if said EAX changing means is not to replace said EAX with said EEAX.

Claim 10

Dependent Claim 177 words

The program authorization mechanism of claim 7 wherein said entry-table entry associated with said called program includes an entry key mask (EKM) in said entry data, said program authorization mechanism further comprising: a second control register for storing a PSW key mask (PKM), said PKM controlling access by said PROGRAM CALL means to the entry-table entry associated with said called program; OR means in said authorization changing means for ORing said EKM into said PKM in said second control register to change said PKM in said second control register such that said changed PKM is hierarchical; replacement means in said authorization changing means for replacing said PKM in said second control register with said EKM such that said replaced PKM is nonhierarchical; and PSW-key-mask control means in each of said entry-table entries for controlling said authorization changing means, said PSW-key-mask control means having a first value when said OR means is to be used by said PROGRAM CALL means and having a second value when said replacement means is to be used by said PROGRAM CALL means.

Claim 11

Dependent Claim 53 words

The program authorization mechanism of claim 8 wherein said calling program is in a first address space and said called program is in a second address space, said program authorization mechanism further comprising: preventing means in said authorization changing means for preventing said called program from having access to said first address space.

Claim 12

Dependent Claim 296 words

The program authorization mechanism of claim 9 wherein said preventing means comprises: a third control register for storing a secondary address space number (SASN) identifying a secondary address space; a fourth control register for storing an old primary address space number (PASN) identifying said first address space as the old primary address space; a fifth control register for storing a secondary segment table designation (SSTD) for locating said secondary address space in said main memory; a sixth control register for storing an old primary segment table designation (PSTD) for locating said old primary address space in said main memory; primary establishing means in said PROGRAM CALL means for establishing a new PASN and a new PSTD for identifying and locating in main memory, respectively, said second address space as the new primary address space; equal setting means in said PROGRAM CALL means for setting a new SASN and a new SSTD in said third and fifth control register, respectively, equal to said old PASN and old PSTD stored in said forth and sixth control registers, respectively, or setting said new SASN and new SSTD equal to said new PASN and new PSTD, respectively; and secondary-ASN control means in each of said entry-table entries for controlling said equal setting means, said secondary-ASN control means having a first value when the new SASN and new SSTD are to be set equal to the old PASN and old PSTD, respectively, thereby allowing said called program to have access to said first address space of said calling program, and having a second value when the new SASN and new SSTD are to be set equal to the new PASN and new PSTD, respectively, thereby preventing said called program from having access to said first address space of said calling program.

Claim 13

Dependent Claim 92 words

The program authorization mechanism of claim 10 further comprising: saving means in said memory for saving the values of EAX, PKM, PASN and SASN as they existed in said control registers before any one has been changed by said authorization changing means; and RETURN MEANS in said operating system for restoring the values of EAX, PKM, PASN and SASN as they were saved in said saving means, said restoring occurring after the called program has been run by said central processor under at least one changed EAX, PKM, PASN or SASN value.

Claim 14

Dependent Claim 385 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each of said instructions having an operand field, said main memory being allocated into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a control register for storing an extended authorization index (EAX) value for the program being executed by said central processor; access-list means having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling access to the address space associated with each access-list entry; access-register translation (ART) means in said central processor having an address space locating means including an input for receiving the contents of said instruction operand field, said address space locating means for locating an entry in said access-list means corresponding to the contents of said instruction operand field thereby locating its associated address space, said ART means further having a first access allowing means for comparing the EAX value in said control register with the ALEAX of the located entry in said access-list, said first allowing means allowing continued execution of the program being executed, thereby allowing access to the address space associated with said located access-list entry when the EAX in said control register is equal to said ALEAX of said located access-list entry; an authority table (AT) in said main memory associated with each of said address spaces, each of said ATs having a plurality of AT entries, one AT entry for each EAX value in use, each AT entry further having an S indicator having a first value when the EAX value is authorized to have access to the associated address space and a second value when the EAX value is not authorized to have access to the associated address space; and second access allowing means in said ART means for allowing access to the address space associated with said selected access-list entry when the S indicator for the AT entry of said EAX value in said control register has its first value.

Claim 15

Dependent Claim 385 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, each of said instructions having an operand field, said main memory being allocated into a plurality of address spaces containing data to be processed by said programs, a program authorization mechanism authorizing a program to access data in one of said address spaces comprising: a control register for storing an extended authorization index (EAX) value for the program being executed by said central processor; access-list means having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling access to the address space associated with each access-list entry; access-register translation (ART) means in said central processor having an address space locating means including an input for receiving the contents of said instruction operand field, said address space locating means for locating an entry in said access-list means corresponding to the contents of said instruction operand field thereby locating its associated address space, said ART means further having a first access allowing means for comparing the EAX value in said control register with the ALEAX of the located entry in said access-list, said first allowing means allowing continued execution of the program being executed, thereby allowing access to the address space associated with said located access-list entry when the EAX in said control register is equal to said ALEAX of said located access-list entry; an authority table (AT) in said main memory associated with each of said address spaces, each of said ATs having a plurality of AT entries, one AT entry for each EAX value in use, each AT entry further having an S indicator having a first value when the EAX value is authorized to have access to the associated address space and a second value when the EAX value is not authorized to have access to the associated address space; and second access allowing means in said ART means for allowing access to the address space associated with said selected access-list entry when the S indicator for the AT entry of said EAX value in said control register has its first value.

Claim 16

Dependent Claim 110 words

The program authorization mechanism of claim 6 wherein each access-list entry includes a private indicator for the associated address space, said private indicator having a first value when all programs are allowed to have data access to said associated address space and having a second value when only authorized programs are allowed to have data access to said associated address space, and third access allowing means in said ART means for examining said private indicator of said selected access-list entry, said third access allowing means allowing access to the address space associated with said selected access-list entry when said private indicator of said selected access-list entry has said first value.

Claim 17

Dependent Claim 27 words

The program authorization mechanism of claim 13 wherein said private indicator is a P bit having a first value of 0 and a second value of 1.

Claim 18

Dependent Claim 27 words

The program authorization mechanism of claim 12 wherein each S indicator is an S bit having a first value of 1 and a second value of 0.

Claim 19

Dependent Claim 18 words

The program authorization mechanism of claim 12 wherein said AT is indexable by the EAX values in use.

Claim 20

Dependent Claim 89 words

The program authorization mechanism of claim 12 further comprising: a plurality of ASN-second-table entries (ASTEs) in said main memory, one ASTE for each of said address spaces; an ASTE address in each of said access-list entries, said ASTE address being the address in main memory of the ASTE of said address space associated with said access-list entry; and an authority-table origin (ATO) in each of said ASTEs, said ATO being the main memory address of the origin of the AT of the address space associated with said access-list entry.

Claim 21

Dependent Claim 113 words

The program authorization mechanism of claim 17 further comprising: an ASTE sequence number (ASTESN) in each of said ASTEs, the ASTESN being assigned to said ASTE at the time the ASTE is associated with one of said address spaces; an access-list ASTESN in each of said access-list entries, the access-list ASTESN being written into each access-list entry at the time the access-list entry is created; and ASTESN comparing means in said ART means for denying access to the associated address space if the ASTESN does not equal the access-list ASTESN such that authority may be withdrawn from all current access-list entries addressing a selected ASTE by changing the ASTESN in said selected ASTE.

Claim 22

Dependent Claim 72 words

The program authorization mechanism of claim 12 further comprising: a test instruction in said operating system having the format TAR A1,R2 wherein A1 indicates the access-list entry to be used for the test and R2 indicates the EAX to be used for the test, said test instruction testing if the value of the EAX indicated by R2 is authorized to use the address space associated with the access-list entry indicated by A1.

Claim 23

Dependent Claim 72 words

The program authorization mechanism of claim 12 further comprising: a plurality of access registers, each access register for containing an access-list-entry token (ALET) designating one of said access-list entries, each of said access registers being addressable by an operand of selected ones of said instructions such that said selected instructions access the address space associated with the access-list entry designated by the ALET of the addressed access register via said ART means.

Claim 24

Dependent Claim 55 words

The program authorization mechanism of claim 20 wherein said access list means comprises a plurality of access lists, and said ALET includes an access-list designation specifying one of said access lists to be used and an access-list entry number designating which entry of said one access list is to be used by said ART means.

Claim 25

Dependent Claim 28 words

The program authorization mechanism of claim 21 wherein said plurality of access lists are divided by tasks being performed by the programs being executed by said central processor.

Claim 26

Dependent Claim 269 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: placing in a selected access register from a plurality of access registers, an access-list entry token (ALET) designating one of said address spaces; executing one of said instructions, said one instruction having an operand addressing said selected access register; establishing an access list having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; placing an access list entry number (ALEN) in each ALET, said ALEN designating one of said access-list entries; placing a P bit in each of said access list entries, said P bit having a first value when the address space associated with the access-list entry is open to all programs, and a second value when the address space associated with the access-list entry is open to only authorized programs; storing in a control register an extended authorization index (EAX) value for said program being run by said operating system; placing an access-list extended authorization index (ALEAX) value in each of said access-list entries; and authorizing access to the address space designated by the ALET in said selected access register by the program being executed by said central processor when the P bit of said designated access-list entry has its first value or said EAX is equal to the ALEAX of said designated access-list entry.

Claim 27

Dependent Claim 269 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: placing in a selected access register from a plurality of access registers, an access-list entry token (ALET) designating one of said address spaces; executing one of said instructions, said one instruction having an operand addressing said selected access register; establishing an access list having a plurality of access-list entries in said main memory, each access-list entry being associated with one of said address spaces; placing an access list entry number (ALEN) in each ALET, said ALEN designating one of said access-list entries; placing a P bit in each of said access list entries, said P bit having a first value when the address space associated with the access-list entry is open to all programs, and a second value when the address space associated with the access-list entry is open to only authorized programs; storing in a control register an extended authorization index (EAX) value for said program being run by said operating system; placing an access-list extended authorization index (ALEAX) value in each of said access-list entries; and authorizing access to the address space designated by the ALET in said selected access register by the program being executed by said central processor when the P bit of said designated access-list entry has its first value or said EAX is equal to the ALEAX of said designated access-list entry.

Claim 28

Dependent Claim 152 words

The program authorization method of claim 23 comprising: prior to said authorizing step, further performing the steps of: establishing an authority table (AT) in said main memory associated with each address space, each AT having an AT entry for each EAX in use; and placing an S bit in each AT entry, said S bit having a first value when the EAX of that AT entry is authorized access to the address space associated with that AT and a second value when the EAX of that AT entry is not authorized access to the address space associated with that AT; and said authorizing step further comprises allowing access to said designated address space by said program being executed by said central processor when the S bit for the AT entry of the AT associated with the designated address space for the EAX value stored in said control register has said first value.

Claim 29

Dependent Claim 45 words

The program authorization method of claim 24 further comprising the steps of: changing the EAX value stored in said control register; and repeating the steps of claim 23 thereby authorizing access by the program being executed by said operating system under said changed EAX value.

Claim 30

Dependent Claim 53 words

The program authorization mechanism of claim 25 further comprising: prior to said changing the EAX value step, the step of saving in main memory the EAX value stored in said control register; and after the final authorizing step, the step of restoring said EAX value from said main memory to said control register.

Claim 31

Dependent Claim 108 words

The program authorization method of claim 23 comprising: prior to said authorizing step, further performing the steps of: establishing in said main memory an ASN-second-table entry (ASTE) associated with each address space; placing an ASTE address in each access-list entry; assigning an ASTE sequence number (ASTESN) value in each ASTE; and placing an access-list ASTESN value in each access-list entry, said access-list ASTESN value being the same as the ASTESN value of the respective ASTE; and said authorizing step further comprises withdrawing authority to access an address space when the access-list ASTESN value of said designated access-list entry does not match the ASTESN value of the respective ASTE.

Claim 32

Dependent Claim 237 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: storing in a controlled register, a changed extended authorization index (EAX) value for the program to be run by said central processor; associating an access-list entry in said main memory with each one of said address spaces; storing an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling program access to the associated address space; selecting an access-list entry for processing data; allowing program access to the address space associated with said selected access-list entry when said changed EAX value stored in said control register is equal to said ALEAX of said selected access-list entry; storing in an entry-table entry in said main memory, an entry key mask (EKM) for a program associated with said entry-table entry; changing a PSW-key mask (PKM) value stored in a second control register by performing one of ORing said EKM into said PKM value to form a changed PKM or replacing said PKM value in said second control register with said EKM to form said changed PKM; and controlling subsequent access to said entry-table entry with said changed PKM value in said second control register.

Claim 33

Dependent Claim 237 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: storing in a controlled register, a changed extended authorization index (EAX) value for the program to be run by said central processor; associating an access-list entry in said main memory with each one of said address spaces; storing an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling program access to the associated address space; selecting an access-list entry for processing data; allowing program access to the address space associated with said selected access-list entry when said changed EAX value stored in said control register is equal to said ALEAX of said selected access-list entry; storing in an entry-table entry in said main memory, an entry key mask (EKM) for a program associated with said entry-table entry; changing a PSW-key mask (PKM) value stored in a second control register by performing one of ORing said EKM into said PKM value to form a changed PKM or replacing said PKM value in said second control register with said EKM to form said changed PKM; and controlling subsequent access to said entry-table entry with said changed PKM value in said second control register.

Claim 34

Dependent Claim 74 words

The program authorization method of claim 28 further comprising: prior to said changing the PKM value step, saving said EAX and said PKM values in said main memory; and further performing the step of restoring said EAX and said PKM values to said control registers with said EAX and said PKM values saved in said main memory, said step of restoring to occur during the execution of a PROGRAM RETURN by said central processor.

Claim 35

Dependent Claim 43 words

The program authorization method of claim 29 further comprising the steps of: calling with a calling program in a first address space, a called program in a second address space; and preventing said called program from having access to said first address space.

Claim 36

Dependent Claim 99 words

The program authorization method of claim 28 further comprising: prior to said selecting an access-list entry step, the step of storing a private indicator in each access-list entry, said private indicator having a first value when all programs are allowed to have access to said associated address space, and having a second value when only authorized programs are allowed to have access to said associated address space; and said allowing access step further comprises allowing access to the address space associated with said selected access-list entry when said private indicator of said selected access-list entry has said first value.

Claim 37

Dependent Claim 251 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: storing in a controlled register, an extended authorization index (EAX) value for the program to be run by said central processor; associating an access-list entry in said main memory with each one of said address spaces; storing an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling program access to the associated address space; establishing an authority table (AT) in said main memory associated with each of said address spaces, each of said ATs having a plurality of AT entries, one AT entry for each EAX value in use, each AT entry further having an S indicator having a first value when the EAX value is authorized to have access to the associated address space and a second value when the EAX value is not authorized to have access to the associated address space; selecting an access-list entry for processing data; and allowing program access to the address space associated with said selected access-list entry when said EAX value stored in said control register is equal to said ALEAX of said selected access-list entry or the S indicator for the respective AT entry of said EAX value in said control register has its first value.

Claim 38

Dependent Claim 251 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing data to be processed by said programs, a program authorization method comprising the steps of: storing in a controlled register, an extended authorization index (EAX) value for the program to be run by said central processor; associating an access-list entry in said main memory with each one of said address spaces; storing an access-list extended authorization index (ALEAX) value in each of said access-list entries for controlling program access to the associated address space; establishing an authority table (AT) in said main memory associated with each of said address spaces, each of said ATs having a plurality of AT entries, one AT entry for each EAX value in use, each AT entry further having an S indicator having a first value when the EAX value is authorized to have access to the associated address space and a second value when the EAX value is not authorized to have access to the associated address space; selecting an access-list entry for processing data; and allowing program access to the address space associated with said selected access-list entry when said EAX value stored in said control register is equal to said ALEAX of said selected access-list entry or the S indicator for the respective AT entry of said EAX value in said control register has its first value.

Claim 39

Dependent Claim 105 words

The program authorization method of claim 32 comprising: prior to said selecting an access-list entry step, further performing the steps of: establishing in said main memory, a plurality of ASN-second-table entries (ASTEs), one ASTE for each of said address space; assigning an ASTE sequence number (ASTESN) in each of said ASTEs; and writing an access-list ASTESN in each access-list entry whose value is the same as the ASTESN of the respective ASTE; and said allowing access step further comprises withdrawing authority to access the associated address space if said access-list ASTESN of said selected access-list entry does not equal the ASTESN of the respective ASTE.

Claim 40

Dependent Claim 360 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into a plurality of address spaces containing programs to be executed under the operating system in said address spaces and data to be processed by said programs, a program authorization mechanism for authorizing program access and data access to said address spaces comprising: a control field for containing an authorization for a program executing under said operating system to call other programs for execution; data access means having an input for receiving program instructions, said data access means having address translating means for translating operands in said program instructions into real addresses for accessing data at said real addresses in a specified address space for data processing by said instructions; access list means having a plurality of access-list entries, each access-list entry corresponding to a selected one of said address spaces for controlling data access of a program by said operating system, each of said access-list entries associated with a data authorization indicating the authorization needed for program access to data in the corresponding address space; entry table means having a plurality of entry-table entries, each entry-table entry corresponding to a selected one of said address spaces for controlling the execution of a program by said operating system, each of said entry-table entries associated with a program authorization indicating the authorization needed for program execution; control transfer means in said operating system for transferring program control from a calling program in a first address space to a called program in a second address space; first authorization means in said operating system for providing access by said data access means to said specified address spaces by only those programs executing under at least the data authorization associated with the access-list entry corresponding to said specified address space; and second authorization means in said operating system for providing access to said first and second address spaces by only those programs executing under at least the program authorization associated with the entry-table entries corresponding to said first and second address spaces.

Claim 41

Dependent Claim 360 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into a plurality of address spaces containing programs to be executed under the operating system in said address spaces and data to be processed by said programs, a program authorization mechanism for authorizing program access and data access to said address spaces comprising: a control field for containing an authorization for a program executing under said operating system to call other programs for execution; data access means having an input for receiving program instructions, said data access means having address translating means for translating operands in said program instructions into real addresses for accessing data at said real addresses in a specified address space for data processing by said instructions; access list means having a plurality of access-list entries, each access-list entry corresponding to a selected one of said address spaces for controlling data access of a program by said operating system, each of said access-list entries associated with a data authorization indicating the authorization needed for program access to data in the corresponding address space; entry table means having a plurality of entry-table entries, each entry-table entry corresponding to a selected one of said address spaces for controlling the execution of a program by said operating system, each of said entry-table entries associated with a program authorization indicating the authorization needed for program execution; control transfer means in said operating system for transferring program control from a calling program in a first address space to a called program in a second address space; first authorization means in said operating system for providing access by said data access means to said specified address spaces by only those programs executing under at least the data authorization associated with the access-list entry corresponding to said specified address space; and second authorization means in said operating system for providing access to said first and second address spaces by only those programs executing under at least the program authorization associated with the entry-table entries corresponding to said first and second address spaces.

Claim 42

Dependent Claim 32 words

The program authorization mechanism of claim 34 further comprising: data authorization changing means in said first authorization means for changing the data authorization of a specified program to a changed data authorization.

Claim 43

Dependent Claim 41 words

The program authorization mechanism of claim 35 wherein said data authorization changing means changes the value of said data authorization to one of a greater or lesser value such that said data authorization may be one of hierarchical or nonhierarchical, respectively.

Claim 44

Dependent Claim 55 words

The program authorization mechanism of claim 36 further comprising: saving means in said main memory and connected to said data authorization changing means for saving said data authorization value before it is changed by said data authorization changing means; and PROGRAM RETURN means for restoring the value of said data authorization from said saving means.

Claim 45

Dependent Claim 32 words

The program authorization mechanism of claim 37 further comprising program authorization changing means in said second authorization means for changing the program authorization of a specified program to a changed program authorization.

Claim 46

Dependent Claim 41 words

The program authorization mechanism of claim 38 wherein said program authorization changing means changes the value of said program authorization to one of a greater or lesser value such that said program authorization may be one of hierarchical or nonhierarchical, respectively.

Claim 47

Dependent Claim 47 words

The program authorization mechanism of claim 39 wherein said saving means includes means for saving said program authorization before it is changed by said program authorization changing means; and said PROGRAM RETURN means includes means for restoring the value of said program authorization from said saving means.

Claim 48

Dependent Claim 33 words

The program authorization mechanism of claim 40 wherein said second authorization means includes preventing means for preventing a program executing in said second address space from having access to said first address space.

Claim 49

Dependent Claim 123 words

The program authorization mechanism of claim 41 wherein said entry table means has at least one entry-table entry associated with each program to be executed by said central processor, each of said entry-table entries having storage means for storing said changed data authorization, a value for replacing or modifying said program authorization for forming said changed program authorization, and control means for controlling said data authorization changing means and said program authorization changing means when said entry-table entry is selected; and PROGRAM CALL means connected to said entry-table means and controlling said data authorization changing means and said program authorization changing means, said PROGRAM CALL means for changing the data authorization and program authorization responsive to the controls in a selected entry-table entry.

Claim 50

Dependent Claim 28 words

The program authorization mechanism of claim 42 wherein said control means further comprises PSW key changing means for giving access to fetch protected code of the next instruction.

Claim 51

Dependent Claim 33 words

The program authorization mechanism of claim 36 further comprising: test means connected to said first authorization means for testing the data authorization of a program without gaining access to said specified address spaces.

Claim 52

Dependent Claim 288 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing programs to be executed under said operating system in said data spaces, a program authorization mechanism comprising: a control field for containing an authorization for a program executing under said operating system to call other programs for execution; entry-table means having a plurality of entry-table entries, each entry-table entry corresponding to a selected one of said address spaces for controlling the execution of a program by said operating system, each of said entry-table entries associated with a program authorization indicating the authorization needed for program execution; control transfer means in said operating system for transferring program control from a calling program in a first address space to a called program in a second address space; authorization means in said operating system for providing access to said first and second address spaces by only those programs executing under at least the program authorization associated with the entry-table entries corresponding to said first and second address spaces; authorization changing means in said authorization means for changing the value of said program authorization to one of a greater or lesser value such that said program authorization may be one of hierarchical or nonhierarchical, respectively; saving means in said main memory for saving said program authorization before it is changed by said program authorization changing means; and PROGRAM RETURN means for restoring the value of said program authorization from said saving means; said authorization means including preventing means for preventing a program executing in said second address space from having access to said first address space.

Claim 53

Dependent Claim 288 words

In a computer system having a central processor, a main memory, and an operating system operating said central processor for executing programs having instructions for processing data, said main memory being allocated into address spaces containing programs to be executed under said operating system in said data spaces, a program authorization mechanism comprising: a control field for containing an authorization for a program executing under said operating system to call other programs for execution; entry-table means having a plurality of entry-table entries, each entry-table entry corresponding to a selected one of said address spaces for controlling the execution of a program by said operating system, each of said entry-table entries associated with a program authorization indicating the authorization needed for program execution; control transfer means in said operating system for transferring program control from a calling program in a first address space to a called program in a second address space; authorization means in said operating system for providing access to said first and second address spaces by only those programs executing under at least the program authorization associated with the entry-table entries corresponding to said first and second address spaces; authorization changing means in said authorization means for changing the value of said program authorization to one of a greater or lesser value such that said program authorization may be one of hierarchical or nonhierarchical, respectively; saving means in said main memory for saving said program authorization before it is changed by said program authorization changing means; and PROGRAM RETURN means for restoring the value of said program authorization from said saving means; said authorization means including preventing means for preventing a program executing in said second address space from having access to said first address space.

Claim 54

Dependent Claim 102 words

The program authorization mechanism of claim 45 wherein said entry table means has at least one entry-table entry associated with each program to be executed by said central processor, each of said entry-table entries having storage means for storing a value for replacing or modifying said program authorization for forming said changed program authorization, and control means for controlling said authorization changing means when said entry-table entry is selected; and PROGRAM CALL means connected to said entry-table means and controlling said authorization changing means, said PROGRAM CALL means for changing the program authorization responsive to the controls in a selected entry-table entry.

Claim 55

Dependent Claim 177 words

The program authorization mechanism of claim 46 wherein said entry-table entry associated with said called program includes an entry key mask (EKM) in said entry data, said program authorization mechanism further comprising: a first control register for storing a PSW key mask (PKM), said PKM controlling access by said PROGRAM CALL means to the entry-table entry associated with said called program; OR means in said authorization changing means for ORing said EKM into said PKM in said first control register to change said PKM in said first control register such that said changed PKM is hierarchical; replacement means in said authorization changing means for replacing said PKM in said first control register with said EKM such that said replaced PKM is nonhierarchical; and PSW-key-mask control means in each of said entry-table entries for controlling said authorization changing means, said PSW-key-mask control means having a first value when said OR means is to be used by said PROGRAM CALL means and having a second value when said replacement means is to be used by said PROGRAM CALL means.

Claim 56

Dependent Claim 296 words

The program authorization mechanism of claim 47 wherein said preventing means comprises: a second control register for storing a secondary address space number (SASN) identifying a secondary address space; a third control register for storing an old primary address space number (PASN) identifying said first address space as the old primary address space; a fourth control register for storing a secondary segment table designation (SSTD) for locating said secondary address space in said main memory; a fifth control register for storing an old primary segment table designation (PSTD) for locating said old primary address space in said main memory; primary establishing means in said PROGRAM CALL means for establishing a new PASN and a new PSTD for identifying and locating in main memory, respectively, said second address space as the new primary address space; equal setting means in said PROGRAM CALL means for setting a new SASN and a new SSTD in said second and fourth control register, respectively, equal to said old PASN and old PSTD stored in said third and fifth control registers, respectively, or setting said new SASN and new SSTD equal to said new PASN and new PSTD, respectively; and secondary-ASN control means in each of said entry-table entries for controlling said equal setting means, said secondary-ASN control means having a first value when the new SASN and new SSTD are to be set equal to the old PASN and old PSTD, respectively, thereby allowing said called program to have access to said first address space of said calling program, and having a second value when the new SASN and new SSTD are to be set equal to the new PASN and new PSTD, respectively, thereby preventing said called program from having access to said first address space of said calling program.

Claim 57

Dependent Claim 84 words

The program authorization mechanism of claim 48 wherein: said saving means saves the values of EAX, PKM, PASN and SASN as they existed in said control registers before any one has been changed by said authorization changing means; and said RETURN MEANS restores the values of EAX, PKM, PASN and SASN as they were saved in said saving means, said restoring occurring after the called program has been run by said central processor under at least one changed EAX, PKM, PASN or SASN value.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	1994-06-10	1994-12-10	1995-06-11	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	1998-06-10	1998-12-10	1999-06-11	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2002-06-10	2002-12-10	2003-06-11	$7700.00	Window Closed / Lapsed

Authorization for selective program access to data in multiple address spaces

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag