Protection of data processing system against unauthorized programs

• US 4,183,085 A
• Filed: 10/21/1977
• Issued: 01/08/1980
• Est. Priority Date: 11/18/1976
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Roberts, David J., Simmons, John
• Primary Examiner(s): Shaw, Gareth D.
• Assistant Examiner(s): Bartz, C. T.
• Application Number:
  US05/844,341
• Time in Patent Office: 809 Days
• Field of Search: 364/200 MS File, 364/900 MS File, 340/149 A, 235/379
• US Class Current: 705/76
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00

Abstract

A data processing system is described which issues value documents e.g. tickets or information under the control of output instructions and is designed to prevent a person attempting fraud using an unauthorized program obtaining the value documents or information. The system includes a data processor controlling output units which can issue value documents or information and data storage. The data storage is divided into a secure store containing the output instructions arranged to make tampering difficult and a free storage into which an operator may load a program. Security logic is provided to check that an output instruction has originated in the secure store and to prevent operation of an output unit which receives output instructions from free storage. This makes it difficult for a person attempting fraud to produce value documents or information by loading a program into free storage.

The secure storage is preferably a read only store programmed during manufacture. When secure and free storage share a common memory bus, the security logic monitors addresses used to fetch instructions.

Claims

1. A method of protecting value documents and restricted information controlled by a data processing system against unauthorized issuance from an output unit operated by the system, comprising providing a special storage area which cannot be modified by a system user for storing output instructions which may be executed by the system to actuate the output unit to issue a value document, providing another storage area into which an operator may load programs and data, detecting whether a current instruction provided for system execution is an output instruction, sensing if each output instruction detected by the detecting step originated in the special storage area, permitting the output unit to be actuated by the output instruction when the sensing step senses origination of the current instruction from the special storage area, and stopping the output unit from issuing any value document under control of the output instruction when the sensing step senses the output instruction did not originate in the special storage area.

2. A method as claimed in claim 1, further comprising providing said special storage area as a read only store.

3. In a data processing system operating an output unit for issuing value documents, means for preventing the issuance of value documents from the output unit by execution of output instructions from an unauthorized source, comprising

a special storage area which cannot be modified by a system user being an authorized source for output instructions,

means for detecting when the current instruction being executed by the data processing system is an output instruction for actuating the output unit to issue a value document and providing an output instruction signal,

sensing means for indicating whether or not the current instruction was accessed in the special storage area and providing an authorization signal,

means for stopping the output unit from issuing the value document in response to no authorization signal being provided from the sensing means while the detecting means is providing an output instruction signal,

whereby the stopping means indicates when the output instruction did not derive from the special storage area and prohibits issuance of the value document.

4. A system as claimed in claim 3, in which a security-protected area in a system main storage comprises the special storage area.

5. A system as claimed in claim 3, further comprising

AND gate means having one input connected to the detecting means to receive output instruction signals and having another input connected to the sensing means to receive inverted authorization signals indicating no authorization, an output of the AND gate means connected to an inhibit input of the output unit to control issuance of value documents by the output unit,

whereby the AND gate means provides the stopping means.

6. A system as claimed in claim 5, further comprising

means for indicating whether the current instruction for the system was accessed from another source of instructions other than the special storage area and providing an unauthorized signal,

a second AND gate means having one input connected to the indicating means to receive the unauthorized signals and having another input connected to the detecting means to receive output instruction signals,

OR circuit means connecting the outputs of both AND gate means to the inhibit input of the output unit to control issuance of value documents,

whereby only output instructions obtained from the special storage area can cause the output unit to issue any value document.