Patent ID: 7565505

Claim:
A system for controlling access to an addressable entity in accordance with a policy, P, the addressable entity defining a first mapping from a first set comprising physical addresses, A, to a second set, M, there being a second mapping from a third set comprising virtual addresses, V, to the first set, the function f: A→M denoting the first mapping, the function g: S×V→A denoting the second mapping, wherein S is a set of sources that can request access to the addressable entity, the system comprising: at least one computing device comprising a processor, a memory in communication with the processor and addressable by the physical addresses, a guard implemented in the processor, wherein the guard evaluates a request from a source, s, to evaluate or modify the first mapping, where s∈S, wherein the guard conditionally allows the request based on a constraint that the request is allowable under the policy, P, and denies the request based on a constraint that the request is not allowable under the policy, P, and also denies the request if execution of the request would cause an invariant condition to be violated, even if the request is otherwise allowable under the policy, P, wherein the invariant condition constrains one or more resources that can be identified using a virtual addresses and is defined such that a set of physical addresses that a source can access through an address translation mechanism using a virtual address and a set of resources to which access by the source is unallowable by the policy are distinct and non-intersecting, and wherein the invariant condition is that a given source has no virtual address for any resource that the source is not allowed to access under the policy, P, wherein the addressable entity comprises the memory, and wherein the guard performs selective filtering to requests from the source by using a plurality of subguards to evaluate conditions that are sufficient to decide whether to allow or deny the request, wherein one of the subguards evaluates a condition that is sufficient and necessary to decide whether to allow or deny the request if none of the other subguards is able to decide whether to allow or deny the request.