Patent ID: 8640194

Claim:
An information processing device comprising: one or more computers comprising: one or more first processors, each belonging to a first domain and each configured to execute a first processing which has a first trust level set according to a security policy; one or more second processor processors, each belonging to a second domain different from the said first domain, and each configured to execute a second processing which has a second trust level set according to said security policy and not higher than the said first trust level; an inter-processor communication unit configured to control a transfer of data or command between said first processor and the said second processor; and an access control unit comprising: a storage unit configured to store access permission data including one or more access information entries, each including: one or more items of processor ID information of one or more second processors configured to execute said second processing; permission range address composed of a start address and an end address of a range in which access is permitted to said one or more second processors configured to execute said second processing; and type information of permitted access to said permission range address by one or more second processors configured to execute said second processing, said access control unit configured to permit write access from said first processor to said access permission data, prevent write access from said second processor to said access permission data, and allow said access permission data to be updated by said first processor; and an access permission unit configured to monitor access from said second processor belonging to said second domain to a memory and/or an input/output device, reference said access permission data, and permit said access from said second processor to a part of said memory and/or a part of said input/output device shared with said first processor, when a processor ID of said second processor matches a processor ID included in said access information entry of said access permission data, an access address from said second processor is within a range specified in said permission range address of said access information entry, and a type of access from said second processor matches a type of permitted access specified in said access information entry.