Abstract:
An inappropriate-access module is incorporated in a computer system along with other computer system modules. The inappropriate-access module is connected to a read address decoder and controlling logic located within various other modules. The inappropriate-access module detects inappropriate read accesses or the occurrence of the inappropriate access during operations performed on related sensitive system resources in accompanying computer system modules. The inappropriate-access module produces an inappropriate-access flag, made available to the rest of the system, which invokes responses in the accompanying modules such as a halt in processing and protective measures for system resources. Additionally, a related logic block is able to detect the inappropriate access and produce an inappropriate-access trigger which causes a halt to processing within the logic block as well as in related system modules.

Description:
TECHNICAL FIELD  
       [0001]     The present invention relates to computer systems and the detecting and reporting of inappropriate accesses. More particularly, the invention relates to a sensing device for detecting an access to system resources during an inappropriate period of time, reporting the occurrence of the access to the rest of the system, and/or suspending execution of a process.  
       BACKGROUND ART  
       [0002]     Computer systems are incorporated into an increasing number of facets of a person&#39;s daily life. Computer systems are responsible for carrying out ever increasing numbers of tasks for people on a daily basis. In order for computer systems to carry out this growing number of tasks, an increasing number of applications from multiple sources must be incorporated and connections to expansive communication networks must take place. Through network connections as well as from (unintentionally) running inappropriate applications, computer systems are exposed to an increasing number of inappropriate accesses to the systems processes and information. Inappropriate access to processes and information may range from being inconvenient to being of a malicious nature, especially where sensitive data retrieval is the result of such an inappropriate access and transmission back to an inappropriate source is a goal.  
         [0003]     Typically, it is difficult for a computer system to detect a condition where an access (i.e., a read access or write access) occurs during an inappropriate period of time, such as when a process involving that resource is underway. A computer system may miss detection of many inappropriate accesses without specific hardware to assist in sensing accesses generally. It would be highly desirable for a computer system to be able to detect access to a critical system resource during processing operations involving the same or related system resources. In addition, it would be highly desirable for a system to be able to detect such an inappropriate access and to determine whether and when to cease processing operations on all related critical system resources.  
       SUMMARY  
       [0004]     A computer system incorporates a range of system modules for carrying out operations relating to a general process capability of the system. An additional system module is used for detection of accesses to system resources during general processing related to the same system resources. The additional system module is an inappropriate-access module which is equipped with a sense circuit that is able to detect an access to a critical system resource. The particular access indication relates to one or more read or write accesses to critical system resources, such as registers or data line containing process sensitive information. The inappropriate-access module is also able to detect concurrent processing in a system operation related to the system resources targeted by a read or write access. A read or write access is an inappropriate access when made concurrently with processing related to the same (i.e., a first) system resource or a concurrent access to an associated system resource related to the processing of the first system resource. When the read access occurs during the related system operation an inappropriate-access flag is produced.  
         [0005]     The inappropriate-access module propagates the inappropriate-access flag to a sample-and-hold circuit. The sample-and-hold circuit retains the inappropriate-access flag until the computer system issues a corresponding reset flag in acknowledgment of receiving the inappropriate access. The inappropriate-access flag serves to signal the CPU and other systems applications that the inappropriate access has occurred. The CPU or system application may take appropriate response to the inappropriate-access flag and cease processing, protect system resources such as registers and data lines, or revert to a previous state of processing for recovery.  
         [0006]     The inappropriate-access flag is also propagated to a logic block where an inappropriate-access trigger is produced. The inappropriate-access trigger is able to invoke a response in other logic functions within the same logic block as well as invoke responses in related computer system modules. The inappropriate-access trigger causes logical operations to cease immediately within the related computer system modules the trigger is connected to.  
         [0007]     The inappropriate-access module provides a mechanism for monitoring critical read accesses, determining that the critical read access occurs during a related sensitive process, and generates a system flag capable of halting processing and protecting system resources. The related inappropriate-access trigger, developed in the logic block, detects that an inappropriate-access has occurred and produces an inappropriate-access trigger which may cause immediate cessation of processing and an ability to protect system resources from an errant or inappropriate source.  
     
    
     BRIEF DESCRIPTION OF DRAWINGS  
       [0008]      FIG. 1  is an exemplary computer system block diagram including a block diagram of an exemplary inappropriate-access module according to the present invention.  
         [0009]      FIG. 2  is an exemplary inappropriate-access-logic-block diagram according to the present invention.  
         [0010]      FIG. 3  is an exemplary process flow diagram of detection of an inappropriate access during processing activity. 
     
    
     DETAILED DESCRIPTION  
       [0011]     With reference to  FIG. 1 , in an exemplary computer system, an address bus  105  connects to a write-address decoder WRITE ADDRESS DECODER  107  and a read-address decoder READ ADDRESS DECODER  109 . An output of the write-address decoder  107  and a write-data bus  110  connect to a configuration-register block CONFIG REGS  112 . The configuration-register block  112  connects to a cipher processor CIPHER PROCESSOR  114  through a plain-text line  115  and a user-key line  120 . A start-command line  125  connects from an output of the configuration-register block  112  to a sequencer SEQUENCER  116 . The sequencer  116  connects to the cipher processor  114  and through a process-status line  118  to an inappropriate-access module  130 . The read-address decoder  109  connects to the inappropriate-access module  130  through a read-cipher line  135  and a read-key line  140 .  
         [0012]     An exemplary embodiment of the inappropriate-access module  130  contains a sense circuit  145  and a sample-and-hold circuit  150 . The sense circuit  145  contains a first AND gate  155  and a first OR gate  160 . The read-cipher line  135  connects to the first AND gate  155  and the read-key line  140  connects to the first OR gate  160 . The process-status line  118  connects from an output of the sequencer  116  to an input of the first AND gate  155 .  
         [0013]     The sample-and-hold circuit  150  contains an inverter  165 , a second AND gate  170 , a second OR gate  175 , and a D flip-flop  180 . An output of the write-address decoder  107  and connects through a reset flag line  196  to the inverter  165 . An output of the inverter  165  connects to an input of the second AND gate  170 . An output of the sense circuit  145  and an output of the second AND gate  170  connect to inputs of the second OR gate  175 . An output of the second OR gate  175  connects to an input D of the D flip-flop  180 . A clock line  182  connects to a clock input and a reset line  184  connects to a reset input of the D flip-flop  180 . The output Q of the D flip-flop  180  connects to an input of the second AND gate  170 . A latch loop is formed by the output Q of the D flip-flop  180  connecting to an input of the second AND gate  170  and the connections between the second AND gate  170 , the second OR gate  175 , and the input D of the D flip-flop  180 . An inappropriate-access line  185  connects from the D flip-flop output Q to an input of a read multiplexer  190 . An output of the cipher processor  114  connects through a cipher-text line  195  to an input of the read multiplexer  190 . An output of the read-address decoder  109  connects through a read-select line  192  to the read multiplexer  190 . The output of the read multiplexer  190  connects to a read-data bus  194 .  
         [0014]     In an exemplary computer system with inappropriate access detection, functional modules are provided with signals and data controlled by a central processor unit CPU (not shown). The address bus  105  provides addresses to two functional modules the write-address decoder  107  and the read-address decoder  109 . Write data is applied to the configuration-regulater block  112  through the write-data bus  110  and is routed to a configuration register corresponding to a write address provided by the write-address decoder  107 . One uniquely chosen address is used to provide a reset flag to potentially many computer system modules on the reset-flag line  196 .  
         [0015]     A cipher process is controlled by the CPU in conjunction with various computer system modules. Configuration registers (not shown) in the configuration-register block  112  are filled with information in order to provide commands and data for the cipher process. Plain text and a user key, for instance, are provided from the configuration-register block  112  to the cipher processor  114  by the plain-text line  115  and the user-key line  120  respectively. The sequencer  116  provides process specific commands to the cipher processor  114 . Operation of the sequencer  116  is initiated by a start command signal provided from a configuration register through the start-command line  125 .  
         [0016]     During the course of sequencer operations a process-underway signal is produced on the process-status line  118 . The process-underway signal is an indication, made available to computer system modules, that a process is underway and is managed, for example, by the sequencer  116 . The cipher processor  114  produces cipher text to the read multiplexer  190  through the cipher-text line  195 . The cipher text is provided to the read-data bus  194  by a corresponding read-cipher address produced by the read-address decodedr  109  over the read-select line  192 . The read-cipher address is decoded within the read multiplexer  190  to provide a connection from the cipher-text line  195  to the read-data bus  194 .  
         [0017]     Any read or write access of resources critical to the cipher process, for example, which is initiated concurrent with cipher operations is considered an inappropriate access. During cipher processing another process executing on the system or another system module may, intentionally or unintentionally, initiate a read operation to access the cipher text or user key. The inappropriate-access module  130  detects both the process-underway signal from the sequencer  116  and any read accesses of relevance to the cipher process occurring inappropriately and concurrently with cipher operations and determines that an inappropriate access has occurred. The inappropriate-access module  130  produces an inappropriate-access flag through the inappropriate-access line  185  when the inappropriate access occurs.  
         [0018]     The sense circuit  145  of the inappropriate-access module  130  detects both process critical read operations and a status of the process. The inappropriate-access module  130  detects the process-underway signal through the process-status line  118 . The process-underway signal is connected through the process-status line  118  to the first AND gate  155  in the sense circuit  145 . A read-cipher signal, indicating the cipher is being read, is produced through the read-cipher line  135  and propagated to the first AND gate  155 . If the read-cipher signal and the process underway signal are received simultaneously then an inappropriate high access flag is produced at the output of the first AND gate  155  indicating an inappropriate access has occurred due to reading a cipher during cipher operations.  
         [0019]     If a user key is being read a read-user-key signal is produced by the read-address decoder  109 . The read-address decoder  109  is modified to add the decoding logic necessary to detect reading of the user key and produce the read-user-key signal. Additional circuitry in the read-address decoder  109  is created to decode addresses corresponding to accesses to the cipher and the user key. As the additional circuitry decodes addresses corresponding to the cipher and the user key, the read-cipher signal and a read-user-key signal are produced. The read-user-key signal is propagated from the read-address decoder  109  through the read-key line  140  to an input of the first OR gate  160 . Logically, when they occur, either the read-user-key signal or the read-cipher signal are propagated to an output of the sense circuit  145  which comes from the first OR gate  160 . The output of the sense circuit  145  is connected to the second OR gate  175  in the sample-and-hold circuit  150 . The sample-and-hold circuit  150  is used to retain any signaling from the sense circuit  145  where a determination is made that the inappropriate access has occurred.  
         [0020]     The inappropriate-access flag is produced on an output of the inappropriate-access module  130  and propagates over the inappropriate-access line  185 . The inappropriate-access flag is produced at the output Q of the D flip-flop  180  and is connected to an input of the second AND gate  170 . The connection from the output Q of the D flip-flop  180 , through the second AND gate  170 , and through the second OR gate  175  to the input D of the D flip-flop  180  provides a feedback latch loop that maintains a record of the inappropriate access. Once set, the record of the inappropriate access is maintained until the reset flag is received from the write address decoder  107  through the reset-flag line  196  and the inverter  166 . Any time the user key is read or there is an occurrence of the cipher being read during cipher processing the inappropriate access flag is produced. The inappropriate access flag serves to notify the CPU or other computer system modules of the occurrence of the inappropriate access. The CPU or system applications executing on the CPU may take advantage of the inappropriate-access flag and cease any further operations in the related process, protect related system resources, such as registers or data lines, or revert to a previous system state to recover from the inappropriate access.  
         [0021]     Additionally, the inappropriate-access module may be used to assist in debug operations. A debugger or in-circuit emulation device may perform an access to a system resource at an inappropriate time. The inappropriate-access module detects a result of an inappropriate access where, for example, an interrupt has not been triggered before the access. Without the interrupt the debugger may make a read or write access that is detected at an inappropriate time. Detection of such a condition may provide input for correcting the debug operation or nullify an incorrect report by the debugger.  
         [0022]     With reference to  FIG. 2 , in an exemplary embodiment of the inappropriate access module, a logic block  205  contains a multiplexer  220 , a first AND gate  225 , an inverter  230 , and a first D flip-flop  235 . A write-data bus  210  connects to an input of the multiplexer  220  and an inappropriate-access line  215  connects to the inverter  230 . An output of a multiplexer  220  connects to a first input of the first AND gate  225 . An output of the inverter  230  connects through an inappropriate-access line  290  to a second input of the first AND gate  225 . An output of the first AND gate  225  connects to an input D of the first D flip-flop  235 . An output Q of the first D flip-flop  235  connects to an input of the multiplexer  220  through a user-key line  260 . A feedback latch loop is formed by connections between an output of the first AND gate  225  to an input D of the first D flip-flop  235 , an output Q of the first D flip-flop  235  to an input of a multiplexer  220 , and an output of the multiplexer  220  to an input of the first AND gate  225 . A clock line  262  connects to a clock input and a reset line  264  connects to a reset input of the first D flip-flop  235 .  
         [0023]     A cipher processor  240  contains a cipher-logic block CIPHER LOGIC  245 , a second AND gate  250 , and a second D flip-flop  255 . An output of the cipher-logic block  245  connects to an input of the second AND gate  250  and an output of the second AND gate  250  connects to an input D of the second D flip-flop  255 . The inappropriate-access line  290  connects to an input of the second AND gate  250 . An output Q of the second D flip-flop  255  connects to inputs of the cipher-logic block  245  and to a cipher-text line  257 . A plain-text line  265  and the user-key line  260  connect to inputs of the cipher-logic block  245 . A feedback latch loop is formed by the connections between the output Q of the second D flip-flop  255  to an input of the cipher-logic block  245 , an output of the cipher-logic block  245  to an input of the second AND gate  250 , and an output of the second AND gate  250  to the input D of the second D flip-flop  255 . The clock line  262  connects to a clock input and the reset line  264  connects to a reset input of the second D flip-flop  255 .  
         [0024]     A sequencer block  270  contains a sequencer-logic block SEQUENCER LOGIC  275 , a third AND gate  280 , and a third D flip-flop  285 . An output of the sequencer-logic block  275  connects to an input of the third AND gate  280  and an output of the third and gate  280  connects to an input D of the third D flip-flop  285 . An output Q of the third D flip-flop  285  connects to an input of the sequencer-logic block  275 . The inappropriate-access line  290  connects to an input of the third AND gate  250 . An output of the sequencer-logic block  275  connects to the cipher-logic block  245 . A feedback latch loop is formed by the connections between an output of the third AND gate  280  to the input D of the third D flip-flop  285 , an output Q of the third D flip-flop  285  to an input of the sequencer-logic block  275 , and an output of the sequencer-logic block  275  to an input of the third AND gate  280 . The clock line  262  connects to a clock input and the reset line  264  connects to a reset input of the second D flip-flop  285 .  
         [0025]     In an exemplary embodiment, during normal operation, no inappropriate-access flag is broadcast, for example from the inappropriate-access module  130  ( FIG. 1 ), and a low-level signal is propagated through the inappropriate-access line  215  to the inverter  230  of the logic block  205 . As a result, a high-level signal is produced at the output of the inverter  230  and is propagated over the inappropriate-access line  290 . The logic block  205  receives user-key data through the write-data bus  210  to the multiplexer  220 . The user-key data propagates through the first AND gate  225  to the input D of the first D flip-flop  235 . Once captured by the first D flip-flop  235 , user-key data is propagated through a latch loop formed by the output Q of the first D flip-flop  235 , the connection to an input of the multiplexer  220 , a selection path through the multiplexer  220 , and the path through the first AND gate  225  to the input D of the first D flip-flop  235 . The high-level signal at the output of the inverter  230  enables propagation of the user-key data through the first AND gate  225 .  
         [0026]     The sequencer  270  receives the high-level signal from the inverter  230  through the inappropriate-access line  290 . The sequencer-logic block  275  propagates control data through the third AND gate  280 , through the third D flip-flop  285 , from the input D to the output Q, and back to an input of the sequencer-logic block  275 . The high-level signal from the inverter  230  is applied to an input of the third AND gate  280  which allows propagation of the control data through the third AND gate  280 .  
         [0027]     The cipher-logic block  245  receives plaintext data through the plain-text line  265  and user-key data through the user-key line  260  through inputs of the cipher processor  240 . The control data is received by the cipher-logic block  245  through the connection from the sequencer-logic block  275 . Cipher text is propagated through the second AND gate  250  to the input D of the second D flip-flop  255 . A latch loop is formed from the output Q of the second D flip-flop  255  to an input of the sequencer-logic block  275 .  
         [0028]     If an inappropriate access is determined by, for instance, an inappropriate-access module  130  ( FIG. 1 ), a high-level signal is produced on the inappropriate-access line  215 . The inverter  230  receives the high-level signal indicating the inappropriate access has occurred and produces an inappropriate-access trigger (a low-level signal) on the inappropriate-access line  290 . The low level of the inappropriate-access trigger on the inappropriate-access line  290  disrupts the propagation path through the respective latch loops of the first AND gate  225 , the second AND gate  250 , and the third AND gate  280 . With propagation through the respective latch loops disrupted, all processing halts in the logic block  205  with respect to user-key data, in the cipher processor  240 , and in the sequencer  270 . In this way the logic block  205  detects the presence of an inappropriate access and causes the suspension of processes in the logic block  205  and related computer system modules with use of the inappropriate-access trigger.  
         [0029]     With reference to  FIG. 3 , an exemplary detection of an inappropriate access during processing activity commences with monitoring  305  for processing activity and determining  310  if processing activity is detected. The process continues with monitoring  325  for an inappropriate access to computer system resources and determining  330  if the inappropriate access has occurred. A system resource targeted for an inappropriate access may be, for example, a register containing a value to be applied in the processing activity or a quantity that is the result of the processing activity.  
         [0030]     A next step in the process is determining  340  if the inappropriate access has occurred during the period that processing activity is detected. If the determination of the inappropriate access occurring during processing activity is affirmed, the process proceeds with triggering  345  a signal flag to be set and maintaining  350  assertion of the signal flag for the duration of processing activity. The process continues with determining  355  if the processing activity is stopped and an acknowledge signal is received. If the determination is that processing activity is not stopped or the acknowledge signal is not received, the process returns to the step of maintaining  350  assertion of the signal flag. If the determination is that processing activity is stopped and the acknowledge signal is received, the process concludes with clearing  360  the signal flag.  
         [0031]     While various portions of an inappropriate access reporting module have been depicted with exemplary components and configurations, an artisan in the computer systems field would readily recognize alternative embodiments for accomplishing a similar result. For instance, a sense circuit has been shown as an AND gate for determining a simultaneous occurrence of two trigger events in combination with an OR gate to produce, alternatively, a singular detection trigger. One skilled in the art would readily recognize that detection of similar events through signals may be detected by other forms of logic gates. For example, combinatorial logic gates, such as NAND or NOR gates or sequential logic such as latches, toggle flip-flops, or master-slave flip-flops may be used to accomplish the same result. One skilled in the art would also recognize an ability to combine further inputs to the combinatorial logic to effect detection of more events.  
         [0032]     Even though a gating function has been represented as an AND gate with a gating signal applied to one input, an artisan in the field would recognize a possibility for various alternatives for implementing a gating function. For example, one skilled in the art would recognize that a signal may be gated or masked by a high logic level applied to a NOR gate with a series inverter at an output. Alternatively a mask gate may be implemented by a low logic level applied to a NAND gate with a series inverter at an output. In yet another alternative a CMOS transmission gate may be used as a gating function where a gating signal is applied to one input of the transmission gate and an inverter is used to drive the other input.  
         [0033]     Additionally, though a sample-and-hold circuit has been shown as a D flip-flop element with a feedback loop including a gating function, one skilled in the art would readily conceive of alternatives for the same recording function. For example, the skilled artisan would readily conceive of alternate storage means such as a latch for storing a record entry for an event such as an inappropriate access in the present invention. Further, one skilled in the art would conceive of several latching elements or toggle flip-flops capable of maintaining a record of events and additionally keeping a count of the number of occurrences of the trigger event by implementing a ripple carry connection among latch elements.