System for providing high security for personal computers and workstations

• US 5,263,147 A
• Filed: 03/01/1991
• Issued: 11/16/1993
• Est. Priority Date: 03/01/1991
• Status: Expired due to Term

• Current Assignee: Hughes Simulation Systems Incorporated
• Original Assignee: Hughes Training, Inc.
• Inventors: Francisco, Emmanuel C., Saunders, Randy
• Primary Examiner(s): CHUN, DEBRA
• Application Number:
  US07/662,659
• Time in Patent Office: 991 Days
• Field of Search: 395/425, 395/575, 395/725, 395/650, 380/3, 380/4
• US Class Current: 711/164
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A security system 31 for use with a base computer system 29 includes an access monitoring unit 100 for continuously monitoring all operations in the memory address space, the input/output address space, or both, of the base computer 1 in parallel with base computer execution. The access monitoring system 100 can include access monitoring memory tables which specify, for a given user, his read access and write access to data stored in the security system, in the base computer system or both.

Claims

1. A security system for use with a computer system having a processing unit and memory comprising:

an access monitor unit connected between the processing unit and the memory of said computer system for continuously monitoring all operations between the memory and the processing unit of the computer system;

security means for controlling the operation of said access monitoring unit to allow or deny access to the memory by the processing unit based on predefined security conditions; and

security computer means communicating with said access monitoring unit for implementing said security means and controlling said access monitoring unit.

2. The security system of claim 1 wherein said access monitoring unit includes access monitor memory tables which specify, for a given user, his read access and write access to data stored in the computer system.

3. The security system of claim 1 wherein said security computer means includes means for associating, with each data subject or object within the memory, data specifying an authorized user.

4. The security system of claim 1 wherein said security computer means is remotely located from said computer system.

5. A security system for use with a computer having a processing unit, memory and a plurality of input/output device drivers comprising access monitoring means for continuously monitoring all operations between the processing unit and the memory, as well as between the processing unit and the input/output device drivers of the computer;

wherein said access monitoring means comprises an access monitoring unit connected between said processing unit and said memory and said input/output device drivers; and

security means for controlling the operation of said access monitoring unit to allow or deny access by the processing unit to the memory or input/output device drivers based on predefined security conditions; and

further comprising security computer means communicating with said access monitoring unit for implementing said security means and controlling said access monitoring unit.

6. The security system of claim 5 wherein said access monitoring unit includes access monitor memory tables which specify, for a given user, his read access and write access to data stored in the computer system.

7. The security system of claim 5 wherein said security computer means includes means for associating, with each data subject or object within the memory, data specifying an authorized user.

8. The security system of claim 5 wherein said security computer means is isolated from said computer system.