Patent US2638538A successfully refreshed from Google Patents.
US6003133A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Data processor with a privileged state firewall and method therefore
Assignee: NXP USA Inc
•
Filing: 1997-11-17
•
Granted: 1999-12-14
•
Expires: 2017-11-17
Abstract
Abstract A data processor (20) includes a firewall circuit (50) that monitors privilege level changes or transitions between privilege modes, such as from user mode and user space into supervisory or privileged mode and operating system space. The firewall circuit starts a timer (54) whenever a central processing unit (22) enters supervisor mode. If the timer (54) determines the passage of a predetermined time while the central processing unit remains continuously in supervisory mode without re-entering user mode, a predefined security policy is invoked. For example, the security policy may require at this point that the data processor (20) is to be reset. Different timer (54) time-out values and different security policies can be set for different types of privilege level changes. In one embodiment, a default time-out value provides protection for multiple types of privilege level changes.
Inventors
- 👤 Claude Moughanni
- 👤 William C. Moyer
- 👤 Taimur Aslam
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-23 21:39
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0245; H04L9/00; H04L9/40
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
153 words
A data processor with a privileged state firewall, comprising: a central processing unit for executing a plurality of instructions and accessing memory in response to an execution of said plurality of instructions, said central processing unit characterized as operating in a first mode and a second mode which is at a lower privilege level than said first mode; when in said first mode said central processing unit allows access to a protected system resource by one of said plurality of instructions; when in said second mode said central processing unit inhibits access to said protected system resource by any of said plurality of instructions; and a firewall circuit coupled to said central processing unit, for recognizing when said central processing unit changes from said second mode to said first mode, and for providing a firewall exception trigger signal if said central processing unit remains in said first mode continuously for a predetermined time.
Claim 2
Dependent Claim
153 words
A data processor with a privileged state firewall, comprising: a central processing unit for executing a plurality of instructions and accessing memory in response to an execution of said plurality of instructions, said central processing unit characterized as operating in a first mode and a second mode which is at a lower privilege level than said first mode; when in said first mode said central processing unit allows access to a protected system resource by one of said plurality of instructions; when in said second mode said central processing unit inhibits access to said protected system resource by any of said plurality of instructions; and a firewall circuit coupled to said central processing unit, for recognizing when said central processing unit changes from said second mode to said first mode, and for providing a firewall exception trigger signal if said central processing unit remains in said first mode continuously for a predetermined time.
Claim 3
Dependent Claim
48 words
The data processor of claim 1 wherein said central processing unit further provides a status signal which identifies a selected one of a plurality of privilege level chances, and said firewall circuit further activates one of a plurality of policy output signals in response to said status signal.
Claim 4
Dependent Claim
65 words
The data processor of claim 1 wherein said central processing unit further provides a status signal which identifies a selected one of a plurality of privilege level changes, and said firewall circuit further activates said firewall exception trigger signal if said central processing unit remains in said first mode continuously for one of a plurality of predetermined times selected in response to said status signal.
Claim 5
Dependent Claim
42 words
The data processor of claim 3 wherein said status signal further identifies a selected one of a plurality of privilege level changes, and said firewall circuit further activates one of a plurality of policy output signals in response to said status signal.
Claim 6
Dependent Claim
137 words
The data processor of claim 1 wherein said firewall circuit comprises: a control logic circuit having an input terminal coupled to said central processing unit for receiving a status signal which identifies a selected one of a plurality of privilege level changes, and an output terminal for providing a selection signal in response to said status signal; a table for storing a plurality of values corresponding to a plurality of privilege level changes, having an input terminal for receiving a selection signal, and an output terminal for providing a value selected by said selection signal at said predetermined time; and timer means coupled to said table for providing said firewall exception trigger signal said predetermined time after said central processing unit changes from said second mode to said first mode and remains in said first mode continuously.
Claim 7
Dependent Claim
30 words
The data processor of claim 5 wherein said timer means includes reset means for resetting said timer means in response to said central processing unit returning to said second mode.
Claim 8
Dependent Claim
162 words
The data processor of claim 1 wherein said firewall circuit comprises: a control logic circuit having an input terminal coupled to said central processing unit for receiving a status signal which identifies a selected one of a plurality of privilege level changes, and an output terminal for providing a selection signal in response to said status signal; a table for storing a plurality of values corresponding to a plurality of privilege level changes, having an input terminal for receiving a selection signal, and an output terminal for providing a value selected by said selection signal; timer means coupled to said table for providing said firewall exception trigger signal said predetermined time after said central processing unit changes from said second mode to said first mode; and a security policy logic circuit coupled to said table for providing one of a plurality of policy output signals in response to said value selected by said selection signal after receiving said firewall exception trigger signal.
Claim 9
Dependent Claim
38 words
The data processor of claim 7 wherein said table comprises a plurality of entries corresponding to one of said plurality of privilege level changes, wherein each entry defines a predetermined time associated with a corresponding privilege level change.
Claim 10
Dependent Claim
44 words
The data processor of claim 7 wherein said table comprises an entry corresponding to at least two of said plurality of privilege level changes, wherein said entry defines a predetermined time associated with said at least two of said plurality of privilege level changes.
Claim 11
Dependent Claim
51 words
The data processor of claim 1 further comprising: a memory for storing said plurality of instructions, wherein said memory stores a first portion of said plurality of instructions which are executed in said first mode, and a second portion of said plurality of instructions which are executed in said second mode.
Claim 12
Dependent Claim
44 words
The data processor of claim 10 wherein said memory further stores a first plurality of data values associated with said first portion of said plurality of instructions, and a second plurality of data values associated with said second portion of said plurality of instructions.
Claim 13
Independent Claim
119 words
A method for providing a privileged state firewall in a data processor, comprising the steps of: recognizing when a central processing unit enters a first mode which is at a higher privilege level than a second mode, said central processing unit allowing access to a protected system resource by one of a plurality of instructions in said first mode and inhibiting access to said protected system resource by any of said plurality of instructions when in said second mode; measuring a passage of time while said central processing unit is continuously in said first mode; determining when said passage of time exceeds a predetermined time; and activating a firewall exception trigger signal in response to said step of determining.
Claim 14
Independent Claim
119 words
A method for providing a privileged state firewall in a data processor, comprising the steps of: recognizing when a central processing unit enters a first mode which is at a higher privilege level than a second mode, said central processing unit allowing access to a protected system resource by one of a plurality of instructions in said first mode and inhibiting access to said protected system resource by any of said plurality of instructions when in said second mode; measuring a passage of time while said central processing unit is continuously in said first mode; determining when said passage of time exceeds a predetermined time; and activating a firewall exception trigger signal in response to said step of determining.
Claim 15
Dependent Claim
49 words
The method of claim 12 further comprising the steps of: identifying one of a plurality of privilege level changes which caused said central processing unit to enter said first mode; and using a value corresponding to said one of said plurality of privilege level changes as said predetermined time.
Claim 16
Dependent Claim
55 words
The method of claim 12 further comprising the steps of: identifying one of a plurality of privilege level changes which caused said central processing unit to enter said first mode; and using a value corresponding to said one of said plurality of privilege level changes to activate one of a plurality of policy output signals.
Claim 17
Dependent Claim
28 words
The method of claim 14 further comprising the step of resetting said central processing unit in response to a selected one of said plurality of policy output signals.
Claim 18
Dependent Claim
34 words
The method of claim 14 further comprising the step of destroying an integrated circuit having said central processing unit integrated thereon in response to a selected one of said plurality of policy output signals.
Claim 19
Dependent Claim
40 words
The method of claim 14 further comprising the step of disabling a peripheral circuit which is integrated with said central processing unit on a single integrated circuit in response to a selected one of said plurality of policy output signals.
Claim 20
Dependent Claim
132 words
In a data processor comprising a central processing unit for executing a plurality of instructions and accessing memory in response to an execution of said plurality of instructions, said central processing unit characterized as operating in a first mode and a second mode which is at a lower privilege level than said first mode, and a timer for counting a predetermined number of periods of a clock signal and providing an output signal in response thereto, the improvement wherein: the timer is part of a firewall circuit and the firewall circuit enables a counting of clock signals by said timer when said central processing unit changes from said second mode to said first mode, and resets said timer when said central processing unit changes from said first mode to said second mode.
Claim 21
Dependent Claim
132 words
In a data processor comprising a central processing unit for executing a plurality of instructions and accessing memory in response to an execution of said plurality of instructions, said central processing unit characterized as operating in a first mode and a second mode which is at a lower privilege level than said first mode, and a timer for counting a predetermined number of periods of a clock signal and providing an output signal in response thereto, the improvement wherein: the timer is part of a firewall circuit and the firewall circuit enables a counting of clock signals by said timer when said central processing unit changes from said second mode to said first mode, and resets said timer when said central processing unit changes from said first mode to said second mode.
Claim 22
Dependent Claim
48 words
The data processor of claim 18 wherein said central processing unit further provides a status signal which identifies a selected one of a plurality of privilege level changes, and said firewall circuit further activates one of a plurality of policy output signals in response to said status signal.
Claim 23
Dependent Claim
65 words
The data processor of claim 18 wherein said central processing unit further provides a status signal which identifies a selected one of a plurality of privilege level changes, and said firewall circuit further activates a firewall exception trigger signal if said central processing unit remains in said first mode continuously for one of a plurality of predetermined times selected in response to said status signal.
Claim 24
Dependent Claim
42 words
The data processor of claim 20 wherein said status signal further identifies a selected one of a plurality of privilege level changes, and said firewall circuit further activates one of a plurality of policy output signals in response to said status signal.
References Cited (Backward Citations)
US4698750A
Cited
US4752930A
Cited
US4763296A
Cited
US5251304A
Cited
US5432950A
Cited
US5564016A
Cited
US5557743A
Cited
US5704039A
Cited
US5724027A
Cited
US5737760A
Cited
US5809544A
Cited
US5677891A
Cited
US5847962A
Cited
US5734820A
Cited
US5805820A
Cited
US5757271A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-12-13 | 2003-06-14 | 2003-12-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-12-13 | 2007-06-14 | 2007-12-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-12-13 | 2011-06-14 | 2011-12-14 | $7700.00 | Window Closed / Lapsed |