The foregoing aspects and many of the attendant advantages of the disclosed subject matter will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:
The following description includes numerous specific details intended to provide a thorough description of the exemplary embodiments of the disclosed subject matter. It will be apparent, however, to one skilled in the art that the disclosed subject matter may be practiced without these specific details. In other instances, well known features have not been described in detail so as not to obscure the disclosed subject matter.
When a computer device is powered on, an SRM (or a functionally similar monitor) is initiated by the operating system of the computer device to enforce an integrity and/or privacy policy of the computer device on all programs executing and objects running on the computer device. In general, in one exemplary operating system employing an embodiment of the disclosed subject matter, the SRM enforces the integrity and/or privacy policy of the computer device by comparing an integrity and/or privacy label assigned to a program to an integrity and/or privacy label assigned to an object that the program is trying to manipulate. Isolation of malicious programs or objects infected by malicious programs is performed by the mandatory security model integrated in the SRM (and in some cases by the object managers of the operating system). Further, even if the security policy of the SPP program is independent of the security policy of the computer device enforced by the mandatory security model integrated into an SRM, the SRM enforces the integrity and/or privacy policy of the computer device on all programs executing and objects running on the computer device.
The disclosed subject matter is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations in which various embodiments of the disclosed subject matter may find use include various types of computer devices and computer systems, including but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
Embodiments of the disclosed subject matter may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer device or system. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. Embodiments of the disclosed subject matter may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
With reference to
As is typical, the exemplary computer 210 includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by the computer 210 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by the computer 210.
Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF, infrared, and other wireless media. Combinations of the any of the above should also be included within the scope of computer readable media.
The system memory 230 includes computer storage media in the form of volatile and/or nonvolatile memory, such as read only memory (ROM) 231 and random access memory (RAM) 232. A basic input/output system 233 (BIOS), containing the basic routines that help to transfer information between elements within computer 210, such as during start-up, is typically stored in ROM 231. The RAM 232 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by the processing unit 220. By way of example, and not limitation,
The computer 210 may also include removable/non-removable, volatile/non-volatile computer storage media. By way of example only,
The drives and their associated computer storage media discussed above and illustrated in
A computer device user may enter commands and information into the computer 210 through input devices, such as a keyboard 262 and pointing device 261, commonly referred to as a mouse, trackball, or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit 220 through a user input interface 260 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, a game port, or a universal serial bus (USB). A monitor 291 or other type of display device is also connected to the system bus 221 via an interface, such as a video interface 290.
The computer 210 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 280. The remote computer 280 may be a personal computer, a server, a router, a network PC, a peer device, or other common network node, and typically includes many or all of the elements described above relative to the computer 210, although only a memory storage device has been illustrated in
When used in a LAN network environment, the computer 210 is connected to the LAN 271 through a network interface adapter 272. When used in a WAN network environment, the computer typically includes a modem 274 or other means for establishing communications over the WAN 273, such as the Internet. The modem, which may be internal or external, may be connected to the system bus 221 via the serial port interface or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 210 or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,
As will be better understood from the following description, the SRM 236 or 246 uses SPP programs 237 or 247 to facilitate the enforcement of the integrity and/or privacy policy of the computer 210. An SPP program is assigned to label (with an integrity and/or privacy label) each program executing or object running on the computer 210. The SPP program is assigned an integrity and/or privacy label based on certain criteria of the program or object that the SPP program is assigned to monitor. One criterion, especially for a program downloaded from the Internet, is the code origin of the program. For example, if the program downloaded from the Internet originates from a company reputed for producing “safe” programs, and can be verified as such, for example by checking digital signatures of the program, the SPP program may assign an integrity label to the program that allows the program write access certain user data and a privacy label that allows the program read access to certain user data. On the other hand, if the program is known to be spyware, by checking a cyclic redundancy check (CRC) or hash across the program binary, the SPP program may assign a low integrity and/or privacy label to the program. The SRM will then not allow the program to modify user data at a higher integrity label or to read user data at a higher privacy label. While various integrity and/or privacy label indications can be used, preferably, the integrity and/or privacy labels are positive integers of the type employed in the Windows operating system. The integrity and/or privacy label of the downloaded program is less than the integrity and/or privacy label assigned to the SPP program. The assigned integrity and/or privacy label of the downloaded program hence prevents the downloaded program from being able to access any data with an integrity and/or privacy label above the level of integrity and/or privacy established by the SPP program or modifying the data of the SPP program.
Returning to
The higher the integrity and/or privacy label of a program and/or object, the greater the amount of private and/or secure data that the program and/or object can access. As mentioned above, then SPP program can only assign an integrity and/or privacy label to the program and/or object the SPP program is assigned to monitor whose value is less than or equal to the integrity and/or privacy label of the assigning SPP program. If, for example, the SPP program is assigned an integrity label 5 and a privacy label 8 by the computer device security policy within the SRM, the SPP program can only assign a maximum integrity label 5 and privacy label 8 to the program and/or object the SPP program is assigned to monitor. Having the SPP program assign an integrity and/or privacy label to the program and/or object that the SPP program is assigned to monitor that is less than the SPP program's own integrity and/or privacy label ensures that the program cannot modify SPP data for its own purposes. According to one embodiment, once the SPP program assigns an integrity and/or privacy label to the program and/or object the SPP program is assigned to monitor, the integrity and/or privacy label cannot be altered (increased or decreased) unless the program and/or object is altered and the alteration to the program and/or object requires an adjustment to the integrity and/or privacy label.
Returning to
As mentioned above, the SPP program uses TCB data to assign an integrity and/or privacy label to the program. The TCB data may include, for example, an integrity and/or privacy policy associated with the digital signer of the program. In this example, the integrity and/or privacy policy determines the integrity and/or privacy label assigned to programs and objects associated with the digital signer. Privacy labels are used to protect programs (or threads of execution) and objects with a higher privacy label from un-authorized modification by programs with a lower privacy label. Similarly, integrity labels are used to protect programs (or threads of execution) and objects with a higher integrity label from un-authorized disclosure by programs with a lower integrity label. In this regard, a specified digital signature controls the level of integrity and/or privacy of data allowed to be accessed by other programs. Another example of the use of TCB data to assign an integrity and/or privacy label to a program is the TCB data including a listing of “known good” or “known bad” programs based on, for example, Windows Defender or other commercially available third party SPTs. If the program (either the newly installed or previously installed program) is a known bad program, such as an MSV program, the program will be assigned a very low integrity and/or privacy label. A very low integrity and/or privacy label prevents the program from accessing any data or other programs that can be used to destabilize the integrity and/or privacy of data and programs with higher integrity and/or privacy labels.
Whether the integrity and/or privacy label of the program is the commonly assigned integrity and/or privacy label (block 405 in
Preferably, the integrity and/or privacy label of the SPP program and the corresponding integrity and/or privacy label of the program or object monitored by the SPP program are maintained in a table located in a secure section of the operating system. Preferably, the secure section also holds the TCB data. Table 1 below illustrates exemplary integrity and/or privacy labels of SPP programs and the corresponding integrity and/or privacy labels assigned by the SPP programs to a program executing and/or object running on the computer device.
In the table above, the sub script of a program or object corresponds to the sub script of the SPP program assigned to monitor the program or object. As mentioned above, the SPP program assigns a positive integer value (integrity and/or privacy label) to the program or object assigned to the SPP program by the SRM. As also mentioned above, the integrity and/or privacy label of a program or object cannot be higher than the integrity and/or privacy label of the assigning SPP program. Further, the integrity and/or privacy label of a program or object cannot be altered once the integrity and/or privacy label is assigned by the SPP program unless the program or object is altered and the alteration requires the integrity and/or privacy label to be either increased or decreased.
While the above description of the disclosed subject matter has been described with reference to the computer device security policy within the SRM assigning an integrity and/or privacy label to SPP programs, the disclosed subject matter is not limited to a computer security policy within a specific SRM assigning an integrity and/or privacy label to specific SPP programs. For example, the SRM can be any functionally similar monitor and the SPP program can be any functionally similar monitoring program such that the monitor forms a part of the operating system and is capable of assigning monitoring programs to monitor the activities of all programs executing and objects running on the computer device. The monitor is also capable of receiving from the monitoring programs policy decisions associated with the program or object assigned to each monitoring program. Finally, the monitor is capable of enforcing the integrity and/or privacy policy of the computer device based on the policy decisions supplied by the monitoring programs.
While illustrative embodiments have been illustrated and described, it will be appreciated that various changes can be made therein without departing from the spirit and scope of the disclosed subject matter. Thus, while preferred embodiments of methods for using integrity and/or privacy policies to improve the integrity and/or privacy of the computer device are described herein, it is to be understood that the embodiments of the disclosed subject matter are not limited to the described methods but rather by the following claims and their full scope of equivalents.