Object encapsulation protection apparatus

• US 6,549,953 B1
• Filed: 07/10/1997
• Issued: 04/15/2003
• Est. Priority Date: 11/09/1994
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Xu, Xin, Voldal, Erik Edward, Halter, Steven Lester, Endicott, John Clarence, Munroe, Steven Jay
• Primary Examiner(s): COURTENAY III, ST JOHN
• Application Number:
  US08/890,906
• Time in Patent Office: 2,105 Days
• Field of Search: 709/300, 709/303, 709/315
• US Class Current: 719/315
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register

Abstract

The present invention utilizes a hardware Window Storage Protection Controller (WSPC) and an Object Encapsulation Enforcement Manager (OEEM) to limit access to object data to only those methods which are encapsulated by the object All of the objects of the computer system which require protection are stored in protected storage by a base storage protection mechanism so that only the mechanisms of the present invention can deny or permit access to the data encapsulated by the objects.

Claims

1. A data protection apparatus, said data protection apparatus comprising:

a first object, said first object being stored on a computer system;

first object data and a first at least one method program associated with said first object; and

a storage protection mechanism which enforces encapsulation of said first object, said storage protection mechanism enforcing encapsulation by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs.

2. The data protection apparatus of claim 1 wherein said first authorized method programs include a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program.

3. The data protection apparatus of claim 2 wherein said second method program is associated with a second object and wherein said second method program is permitted to access second object data associated with said second object, said second method program being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program.

4. The data protection apparatus of claim 3 wherein said first authorized method programs are not permitted to access data other than said first object data and said second authorized method programs are not permitted to access data other than said first object data and said second object data.

5. The data protection apparatus of claim 4 wherein said encapsulation enforcement mechanism further restricts access based on access permissions that are associated with said first authorized method programs and said second authorized method programs.

6. The data protection apparatus of claim 5 further comprising an Object Encapsulation Enforcement Manager and a Window Storage Protection Controller.

7. The data protection apparatus of claim 6 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a first access window for said first authorized method programs and for said second authorized method programs, said first access window being a first address range within data storage, said first address range corresponding in location and size to said first object.

8. The data protection apparatus of claim 7 wherein said Object Encapsulation Enforcement Manager further comprises means for opening a second access window for said second authorized method programs, said second access window being a second address range within said data storage, said second address range corresponding in location and size to said second object.

9. The data protection apparatus of claim 8 wherein said Window Storage Protection Controller further comprises at least one window storage protection register pair, said at least one window storage protection register pair comprising a low order register and a high order register.

10. The data protection apparatus of claim 9 wherein said Object Encapsulation Enforcement Manager further comprises means for loading an object ID into said low order register and means for loading a merged mask into said high order register, said object ID being a starting address of said first object, said merged mask being access permissions combined with a binary representation of said first object'"'"'s length.

11. A method for providing data protection within a computer system, said method comprising the machine executed steps of:

calling a first server method program of a first server object, said first server method program being one of at least one first server method programs associated with said first server object, said first server object having first object data and being stored on a computer system, said first server object being called by a client object;

enforcing encapsulation of said first server object by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first server method program being included in said first authorized method programs.

12. The method of claim 11 wherein said first authorized method programs include a second server method program, said second server method program being further associated with a chain of method program calls, said chain of method program calls involving at least said first server method program and said second server method program.

13. The method of claim 12 comprising the step of permitting said second server object to access second object data associated with a second server object, said second server method program being one of at least one second server method programs associated with said second server object, said second server method program also being one of second authorized method programs, said second authorized method programs being a set of method programs which includes at least one method program.

14. The method of claim 13 further comprising the steps of:

permitting said first authorized method programs to access only said first object data; and

permitting said second authorized method programs to access only said first object data and said second object data.

15. The method of claim 14 wherein said enforcing step further comprises the step of restricting access based on access permissions that are associated with said first authorized method programs and said second authorized programs.

16. The method of claim 15 further comprising the step of:

opening a first access window for said first authorized method programs and for said second authorized method programs, said first access window being a first address range within data storage, said first address range corresponding in location and size to said first object.

17. The method of claim 16 comprising the step of:

opening a second access window for said second authorized method programs, said second access window being a second address range within said data storage, said second address range corresponding in location and size to said second object.

18. The method of claim 17 further comprising the steps of:

loading a first object ID into a first low order register, said first object ID being a starting address of said first object;

loading a first merged mask into a first high order register, said first merged mask being access permissions combined with a binary representation of said first object'"'"'s length.

19. The method of claim 18 further comprising the steps of:

loading a second object ID into a second low order register, said second object ID being a starting address of said second object;

loading a second merged mask into a second high order register, said second merged mask being access permissions combined with a binary representation of said second object'"'"'s length.

20. A computer system, said computer system comprising:

a central processing unit;

data storage;

at least one system bus;

a first object, said first object being stored in said data storage;

first object data and a first at least one method program associated with said first object; and

a storage protection mechanism which enforces encapsulation of said first object, said storage protection mechanism enforcing encapsulation by restricting access to said first object data to only first authorized method programs, said first authorized method programs being a set of method programs which includes at least one method program, said first method program being included in said first authorized method programs.

21. The computer system of claim 20 wherein said first authorized method programs include a second method program, said second method program being associated with a chain of method program calls, said chain of method program calls involving at least said first method program and said second method program.