초록 ▼

Two computing subsystems are disclosed, one a control subsystem, the other a user subsystem, each using engines with augmented conventional instruction sets, together with hardware and/or firmware, to compartmentalize execution of user programs to insure their behavior does not exceed defined bounds

Two computing subsystems are disclosed, one a control subsystem, the other a user subsystem, each using engines with augmented conventional instruction sets, together with hardware and/or firmware, to compartmentalize execution of user programs to insure their behavior does not exceed defined bounds. Programs hidden in data cannot execute. User programs cannot alter the control program that manages the overall system.

대표청구항 ▼

1. A computer system comprising: a first subsystem;a control program that resides and executes in a control subsystem within the first subsystem that includes one or more CPU(s) each with an associated memory, wherein the control subsystem is protected by one or more of hardware and firmware from ac

1. A computer system comprising: a first subsystem;a control program that resides and executes in a control subsystem within the first subsystem that includes one or more CPU(s) each with an associated memory, wherein the control subsystem is protected by one or more of hardware and firmware from access by programs located in other parts of the system, and at least the associated memory of the control subsystem contains programs and data that constitute information required to manage, supervise, and support the system, wherein the control program further has access to information in a remainder of the system, and an ability to control processes and information in the remainder of the system; anda second subsystem including one or more additional CPU(s) each with an associated memory, the second subsystem does not boot but begins execution upon receipt of an instruction from a control subsystem CPU via a hardware/firmware dispatcher, the second subsystem providing a facility for execution and storage of user programs and one or more of user data and databases, wherein the hardware/firmware dispatcher between the control subsystem and the second subsystem facilitates the ability of the control subsystem to manage and control the second subsystem, and buffers the control subsystem from the second subsystem and enables communication between the two subsystems, the hardware/firmware dispatcher between the control subsystem and the second subsystem insulates the control subsystem from any interference by the second subsystem by not allowing the second subsystem access to operating system memory or storage, and controls the dispatching and execution of user programs in the second subsystem in response to commands and data from the control subsystem, and relays information from the second subsystem to the control subsystem, the hardware/firmware dispatcher further providing dynamic monitoring of user program execution to limit an instruction set available to a user program in the second subsystem. 2. The system of claim 1, wherein the first subsystem further includes storage. 3. The system of claim 1, wherein the one or more additional CPU(s) in the second subsystem begin execution, their instruction counter having initially been set to null, only when the control subsystem, via the hardware/firmware dispatcher initializes the instruction counter. 4. The system of claim 3, wherein the second subsystem further includes storage. 5. A computer system, including a first subsystem a second subsystem, and a control program that resides and executes in a control subsystem within the first subsystem that includes one or more CPU(s) each including an associated memory, wherein the control subsystem is protected by one or more of hardware and firmware from access by programs located in other parts of the computer system, and at least the associated memory of the control subsystem contains programs and data that constitute information required to one or more of manage, supervise, and support the computer system, wherein the control program further has access to information in a remainder of the computer system, and an ability to control processes and information in the remainder of the computer system; and the second subsystem including one or more CPU(s) and associated memory, wherein the second subsystem does not boot but begins execution upon receipt of an instruction from a hardware/firmware dispatcher associated with the first subsystem, wherein user program instructions are controlled by one or more of hardware and firmware to be read-only, preventing instructions from modification during loading or execution, the hardware/firmware dispatcher between the first subsystem and the second subsystem insulates the first subsystem from any interference by the second subsystem by not allowing the second subsystem access to operating system memory or storage, and controls the dispatching and execution of user programs in the second subsystem in response to commands and data from the first subsystem, and relays information from the second subsystem to the first subsystem, the hardware/firmware dispatcher further providing dynamic monitoring of user program execution to limit an instruction set available to a user program in the second subsystem. 6. A computer system architecture including a first subsystem and a second subsystem, each subsystem including one or more CPU(s) and associated memory, respectively, and a control program that resides and executes in a control subsystem within the first subsystem, wherein the control subsystem is protected by one or more of hardware and firmware from access by programs located in other parts of the computer system, and at least the associated memory of the control subsystem contains programs and data that constitute information required to one or more of manage, supervise, and support the computer system, wherein the control program further has access to information in a remainder of the computer system, and an ability to control processes and information in the remainder of the computer system; and wherein the second subsystem does not boot but begins execution upon receipt of an instruction from a hardware/firmware dispatcher associated with the first subsystem wherein, by one or more of hardware and firmware, data is distinguished from instructions, enabling these two classes of information to be treated separately, the hardware/firmware dispatcher between the first subsystem and the second subsystem insulates the first subsystem from any interference by the second subsystem by not allowing the second subsystem access to operating system memory or storage, and controls the dispatching and execution of user programs in the second subsystem in response to commands and data from the first subsystem, and relays information from the second subsystem to the first subsystem, the hardware/firmware dispatcher further providing dynamic monitoring of user program execution to limit an instruction set available to a user program in the second subsystem. 7. The system of claim 1, wherein the control subsystem includes a CPU of the one or more CPUs running a kernel control program, and the one or more CPU's and associated memories are available for executing secure system services including one or more of encryption, storage of information and backups. 8. The system of claim 1, wherein the second subsystem memory utilizes a virtual memory organization, and unique, separate, virtual memories are used for programs and for data. 9. The system of claim 1, wherein an addressing scheme utilizes instruction set tags to identify segments within a partition, and segments may be data or instruction segments, and the tags enable relative addressing to be used for each segment. 10. A computer system including a first subsystem and a second subsystem, each subsystem including one or more CPU(s) and associated memory, respectively, and a control program that resides and executes in a control subsystem within the first subsystem, wherein the control subsystem is protected by one or more of hardware and firmware from access by programs located in other parts of the computer system, and at least the associated memory of the control subsystem contains programs and data that constitute information required to one or more of manage, supervise, and support the computer system, wherein the control program further has access to information in a remainder of the computer system, and an ability to control processes and information in the remainder of the computer system; and wherein the second subsystem does not boot but begins execution upon receipt of an instruction from a hardware/firmware dispatcher associated with the first subsystem, wherein one or more of hardware and firmware limit the dynamic addresses employed during the execution of a program to values specified by a control program, the hardware/firmware dispatcher between the first subsystem and the second subsystem insulates the first subsystem from any interference by the second subsystem by not allowing the second subsystem access to operating system memory or storage, and controls the dispatching and execution of user programs in the second subsystem in response to commands and data from the first subsystem, and relays information from the second subsystem to the first subsystem, the hardware/firmware dispatcher further providing dynamic monitoring of user program execution to limit an instruction set available to a user program in the second subsystem. 11. A computing device comprising: a first subsystem containing one or more CPU(s) each with an associated memory and control programs and data; and a control subsystem protected by one or more of hardware and firmware from access by programs located in other parts of the device, wherein at least the associated memory of the control subsystem contains programs and data that constitute information required to one or more of manage, supervise, and support the computer system, wherein the control program further has access to information in a remainder of the computer system, and an ability to control processes and information in the remainder of the computer system; anda second subsystem adapted for user program execution, wherein the first subsystem assembles a control block containing parameters to supervise a program's execution, and wherein a hardware/firmware dispatcher reads the control block and uses the information to initiate and control a user program executing in the second subsystem, including monitoring instruction and data addresses to ensure they so not exceed an assigned address space in memory and that the program's access to data agrees with a permitted limit defined in the control block, the hardware/firmware dispatcher between the first subsystem and the second subsystem insulates the first subsystem from any interference by the second subsystem by not allowing the second subsystem access to operating system memory or storage, and controls the dispatching and execution of user programs in the second subsystem in response to commands and data from the first subsystem, and relays information from the second subsystem to the first subsystem, the hardware/firmware dispatcher further providing dynamic monitoring of user program execution to limit an instruction set available to a user program in the second subsystem. 12. The system of claim 11, further comprising initializing and booting a control CPU in the first subsystem. 13. The system of claim 11, wherein secure input is received from one or more sources. 14. The system of claim 11, wherein an unauthorized user application or process is halted. 15. The system of claim 11, wherein a post is monitored and recognized. 16. The system of claim 11, further comprising the first subsystem collecting parameters associated with an error, sending notification to a system programmer and erasing a task from a CPU memory. 17. The system of claim 11, wherein the first subsystem allocates memory space and loading one or more programs into second subsystem memory. 18. The system of claim 11, wherein the first subsystem monitors execution times of the program. 19. The system of claim 11, wherein a control program residing on a secure CPU, assisted by a hardware/firmware interface unit sends an instruction to begin execution of the user program. 20. The system of claim 11, wherein a control program residing on the first subsystem performs the monitoring step.