Object encapsulation protection apparatus

Claim 2

A data protection apparatus, said data protection apparatus comprising: at least one multidrop bus; data storage, said data storage being comprised of random access storage and magnetic storage, said data storage being connected to said multidrop bus; and a Window Storage Protection Controller connected to said multidrop bus, said Window Storage Protection Controller comprising: at least one window storage protection register pair, said at least one window storage protection register pair comprising a low order register and a high order register, said low order register containing an object ID, said high order register containing a merged mask, said object D being a starting address of an object stored in said data storage, said merged mask being access permissions combined with a binary representation of said object's length; address input means for accepting a presented address, said presented address being a memory location within said data storage where access is requested; instruction input means for accepting an operation to be performed upon said access; a comparator for comparing a product of said presented address and said mask with said object ID, said comparator generating a first output when said presented address is within a range of memory corresponding to said object and a second output when said presented address is not within said range of memory corresponding to said object; and a storage protection mechanism for generating a storage protection violation indication when said comparator generates said second output.

Claim 3

A data protection apparatus, said data protection apparatus comprising: a first object, said first object being stored on a computer system; first object data and a first at least one method program associated with said first object; and a storage protection mechanism that includes an Object Encapsulation Enforcement Manager and a Window Storage Protection Controller, said storage protection mechanism enforcing encapsulation of said first object by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs, said first authorized method programs including a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program, said second method program being associated with a second object, said second method program being permitted to access second object data associated with said second object, said second method program being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program, said first authorized method programs not being permitted to access data other than said first object data and said second authorized method programs not being permitted to access data other than said first object data and said second object data, said first authorized method programs and said second authorized method programs having access further restricted based on access permissions.

Claim 4

A data protection apparatus, said data protection apparatus comprising: a first object, said first object being stored on a computer system; first object data and a first at least one method program associated with said first object; and a storage protection mechanism that includes an Object Encapsulation Enforcement Manager and a Window Storage Protection Controller, said storage protection mechanism enforcing encapsulation of said first object by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs, said first authorized method programs including a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program, said second method program being associated with a second object, said second method program being permitted to access second object data associated with said second object, said second method program being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program, said first authorized method programs not being permitted to access data other than said first object data and said second authorized method programs not being permitted to access data other than said first object data and said second object data, said first authorized method programs and said second authorized method programs having access further restricted based on access permissions.

Claim 5

The data protection apparatus of claim 2 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a first access window for said first authorized method programs and for said second authorized method programs, said first access window being a first address range within data storage, said first address range corresponding in location and size to said first object.

Claim 6

The data protection apparatus of claim 3 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a second access window for said second authorized method programs, said second access window being a second address range within said data storage, said second address range corresponding in location and size to said second object.

Claim 7

The data protection apparatus of claim 4 wherein said Window Storage Protection Controller further comprises at least one window storage protection register pair, said at least one window storage protection register pair comprising a low order register and a high order register.

Claim 8

The data protection apparatus of claim 5 wherein said Object Encapsulation Enforcement Manager further comprises means for loading an object ID into said low order register and means for loading a merged mask into said high order register, said object ID being a starting address of said first object, said merged mask being access permissions combined with a binary representation of said first object's length.

Claim 9

A computer system, said computer system comprising: a central processing unit data storage; at least one system bus; a first object, said first object being stored in said data storage; first object data and a first at least one method program associated with said first object; and a storage protection mechanism that includes an Object Encapsulation Enforcement Manager and a Window Storage Protection Controller, said storage protection mechanism enforcing encapsulation of said first object by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs, said first authorized method programs including a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program, said second method program being associated with a second object, said second method program being permitted to access second object data associated with said second object, said second method program being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program, said first authorized method programs not being permitted to access data other than said first object data and said second authorized method programs not being permitted to access data other than said first object data and said second object data, said first authorized method programs and said second authorized method programs having access further restricted based on access permissions.

Claim 10

A computer system, said computer system comprising: a central processing unit data storage; at least one system bus; a first object, said first object being stored in said data storage; first object data and a first at least one method program associated with said first object; and a storage protection mechanism that includes an Object Encapsulation Enforcement Manager and a Window Storage Protection Controller, said storage protection mechanism enforcing encapsulation of said first object by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs, said first authorized method programs including a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program, said second method program being associated with a second object, said second method program being permitted to access second object data associated with said second object, said second method program being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program, said first authorized method programs not being permitted to access data other than said first object data and said second authorized method programs not being permitted to access data other than said first object data and said second object data, said first authorized method programs and said second authorized method programs having access further restricted based on access permissions.

Claim 11

The computer system of claim 7 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a first access window for said first authorized method programs and for said second authorized method programs, said first access window being a first address range within data storage, said first address range corresponding in location and size to said first object.

Claim 12

The computer system of claim 8 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a second access window for said second authorized method programs, said second access window being a second address range within said data storage, said second address range corresponding in location and size to said second object.

Claim 13

The computer system of claim 9 wherein said Window Storage Protection Controller further comprises at least one window storage protection register pair, said at least one window storage protection register pair comprising a low order register and a high order register.

Claim 14

The computer system of claim 10 wherein said Object Encapsulation Enforcement Manager further comprises means for loading an object ID into said low order register and means for loading a merged mask into said high order register, said object ID being a starting address of said first object, said merged mask being access permissions combined with a binary representation of said first object's length.