The holder of the '717 patent has sued Microsoft, Symantec, CA, F-Secure, McAfee, Kaspersky, Sophos, Novell, and PC Tools for infringing this patent.
#128Authorization for selective program access to data in multiple address spaces
Applies to Claims 1,120,61
Last updated: about 1 year ago
Summary / Description
Summary / DescriptionThe multiple address space (MAS) facility of the present invention provides 16 32-bit access registers numbered 0-15. In the access register mode, which results when the DAT is on and PSW bits 16 and 17 are 01 binary, an instruction B or R field that is used to specify the logical address of a storage operand designates not only a general register but also an access register.
 
Basic Information
Type of Prior ArtIssued Patents - US
 
CountryUnited States of America
 
Patent/Application #5023773
 
Kind CodeUnited States (US) - United STATES Patent - A
 
Patentee NameInternational Business Machines Corporation
 
Relevant Pages, Columns, or Linescol. 7, ln 13-68
 
URLhttp://patft.uspto.gov/netacgi/...
 
Publication DateFebruary 10, 1988
 
Additional Information
 
Notes / To Do
Notes
 
Excerpt
The multiple address space (MAS) facility of the present invention provides 16 32-bit access registers numbered 0-15. In the access register mode, which results when the DAT is on and PSW bits 16 and 17 are 01 binary, an instruction B or R field that is used to specify the logical address of a storage operand designates not only a general register but also an access register. The designated general register is used in the ordinary way to form the logical addresses of the storage operand. The designated access register is used to specify the address space to which the logical address is relative by specifying a segment-table designation used by the DAT to translate the logical address for the address space. The access register itself does not contain the segment-table designation. An access register may specify the primary or secondary segment-table designations stored in control registers 1 or 7, respectively, or it may specify a segment-table designation (STD) contained in an ASTE. In the latter case, the access register designates an entry in a table called an access list by means of an access-list-entry token (ALET), and the designated access-list entry in turn designates the ASTE. The access list may be either a dispatchable-unit access list (DUAL) or a primary space access list (PSAL). Although an access list is associated with either a dispatchable unit or a primary address space, the valid entries in the list are intended to be associated with the different programs that are executed, in some order, to perform the work of the dispatchable unit. It is intended that each program be able to have a particular authority that permits the use of only those access-list entries that are associated with the program. The authority is represented by a 16-bit extended authorization index (EAX) in control register 8. Other elements used in the related authorization mechanism are a private bit in the access-list entry, an access-list entry authorization index (ALEAX) in the access-list entry, and the S bits of the authority table provided by the aforementioned DAS facility. The private bit and the ALEAX field in the access list entry provide high performance authorization mechanisms to grant or prohibit a program's access to an address space represented by the ALE. The private bit can be 0, thus allowing all programs which execute with the access list to access the address space represented by the ALE. The ALE private bit can be 1 and the user's EAX in control register 8 can be equal to the ALEAX field. This allows programs with a particular EAX to access the address space represented by the ALE. Finally, the ALE private bit can be one and the user's control register 8 EAX can select an entry in the target space's authority table which has the S bit equal to one. This allows multiple programs running with different EAXs to access the address space represented by the ALE.
Relevance
Claims
Claim 61

In a digital computer system for providing improved computer security having digital data processing means for executing a plurality of digital computer programs for a computer user and memory means for storing digital program instructions and digital data, apparatus for protecting a digital computer user from operations typically performable by a digital computer program executing on behalf of a user comprising: a) means for storing digital authorization information in said memory means which restricts an associated program from performing operations, when executed by said processing means, which are available to said computer user; and b) means for storing in at least one segment digital data for associating said authorization information with at least one program to be executed by said processing means.
Relevance
a) means for storing digital authorization information in said memory means which restricts an associated program from performing operations, when executed by said processing means, which are available to said computer user; and b) means for storing in at least one segment digital data for associating said authorization information with at least one program to be executed by said processing means.
a) means for storing digital authorization information in said memory means which restricts an associated program from performing operations, when executed by said processing means, which are available to said computer user; and b) means for storing in at least one segment digital data for associating said authorization information with at least one program to be executed by said processing means.
Claim Chart
All
Claim 1

In a digital computer system having a digital data processing means for executing a plurality of digital programs and a memory means for storing digital program instructions and digital data, apparatus for protecting a digital computer user from operations typically performable by a digital computer program executing on behalf of a user comprising: a) means for storing a plurality of digital authorization entries in said memory means, wherein said entries qualify operations which an associated program is permitted to perform when executed by said processing means; and b) means for storing in at least one segment, digital data for associating said authorization entries with at least one program.
Relevance
a) means for storing a plurality of digital authorization entries in said memory means, wherein said entries qualify operations which an associated program is permitted to perform when executed by said processing means; and b) means for storing in at least one segment, digital data for associating said authorization entries with at least one program.
a) means for storing a plurality of digital authorization entries in said memory means, wherein said entries qualify operations which an associated program is permitted to perform when executed by said processing means; and b) means for storing in at least one segment, digital data for associating said authorization entries with at least one program.
Claim Chart
All
Claim 120

In a digital computer system having digital data processing means for executing a plurality of digital computer programs for a computer user and memory means for storing digital program instructions and digital data, a method for providing improved computer security comprising the steps of: a) storing digital authorization information in said memory means which restricts an associated program from accessing resources when executed by said digital data processing means which are accessible to said computer user; and b) storing in at least one segment, digital data for associating said authorization information with at least one program to be executed by said processing means for said computer user.
Relevance
a) storing digital authorization information in said memory means which restricts an associated program from accessing resources when executed by said digital data processing means which are accessible to said computer user; and b) storing in at least one segment, digital data for associating said authorization information with at least one program to be executed by said processing means for said computer user.
a) storing digital authorization information in said memory means which restricts an associated program from accessing resources when executed by said digital data processing means which are accessible to said computer user; and b) storing in at least one segment, digital data for associating said authorization information with at least one program to be executed by said processing means for said computer user.
Claim Chart
All