Secure computer architecture

• US 6,115,819 A
• Filed: 11/26/1996
• Issued: 09/05/2000
• Est. Priority Date: 05/26/1994
• Status: Expired due to Fees

• Current Assignee: Commonwealth of Australia
• Original Assignee: Commonwealth of Australia
• Inventors: Anderson, Mark Stephen
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Elisca, Pierre E.
• Application Number:
  US08/737,908
• Time in Patent Office: 1,379 Days
• Field of Search: 395/186, 395/187.01, 395/188.01, 395/609, 395/490, 395/491, 380/3, 380/4, 380/23, 380/25, 713/200, 713/201, 713/202
• US Class Current: 726/20
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A secure computer architecture having a central processing unit, zero or more memories, at least one input, at least one output and a bus to communicate signals between the components which are all untrusted elements. The computer architecture also includes a trusted access monitor device, a trusted gateway device located between each of the memories, a further trusted gateway device located between each of the inputs and the bus, and a further trusted gateway device located between each of the outputs and the bus, where the access monitor device controls either the one-way or two-way direction of the signals through a respective gateway device. In one aspect of the invention each memory location is each of the zero or more memories, and each input and each output has a respective tag which is representative of a security related attribute associated with the data in that memory location or that input or that output. The trusted access monitor contains tags which are representative of other security attributes of the processes that can be processed by the central processing unit, whereby when the central processing unit attempts to perform an access to data in a memory location or an input operation using the input or an output operation using the output, the access monitor compares the respective tags and controls either the one-way or two-way direction of the signals through a respective gateway device. The architecture disclosed can be adapted to fit within a device which connects to a peripheral input/output port of an untrusted computer device.

Claims

1. A secure computer apparatus comprising

a central processing means, at least one input means, at least one output means and bus means to communicate signals between said means all being untrusted,

a trusted access monitor device connected to said bus means,

a trusted gate device located between each of said at least one input means and said bus means,

a further trusted gate device located between each of said at least one output means and said bus means,

wherein said access monitor device controls either the one-way or tag-way direction of said signals through a respective gate device.

2. A secure computer apparatus in accordance with claim 1 further comprising at least one memory means operable with said central processing means.

3. A secure computer apparatus in accordance with claim 1 further comprising at least one memory means and a further trusted gate device located between said at least one memory means and said bus means.

4. A secure computer apparatus in accordance with claims 2 or 3 wherein

at least one memory location in each of said memory means, and each of said at least one input and output means is associated with a security related attribute that can be processed by said central processing unit means, such that when the central processing unit means attempts to access a memory location or use said input or output means, said access monitor controls the one-way or two-way direction of said signals through a respective gate device according to said security related attribute.

5. A secure computer apparatus in accordance with claim 1 further comprising at least one memory means adapted for connection to one of said at least one input means which is at least readable by said central processing means when permitted by said access monitor device.

6. A secure computer apparatus in accordance with claims 3 or 5 wherein

at least one memory location in each of said memory means, and each of said at least one input and output means is associated with a respective tag which is representative of a security related attribute that can be processed by said central processing unit means, such that when the central processing unit means attempts to access a tagged memory location or use said input or output means, said access monitor controls the one-way or two-way direction of said signals through a respective gate device according to respective tags.

7. A secure computer apparatus in accordance with claim 6 wherein said trusted access monitor device tags are changeable.

8. A secure computer apparatus in accordance with claim 1 wherein said access monitor controls the operation of said central processing means.

9. A secure computer apparatus in accordance with claim 1 wherein said secure computer apparatus is provided in a portable module adapted to connect to a peripheral input/output port of a computer device.