Patent Application
20090178103
The present invention relates to computer systems, and particularly relates to a method and system of specifying and enforcing at least one run-time policy for at least one computer process executing on a computer system, where the computer system includes a computer operating system.
A computer system typically includes an operating system. Computer processes running on the computer system may attempt to access at run-time the computer system's file system, system configuration, and/or network stack.
A computer system needs the ability to perform enforce run-time policies on computer processes executing on the computer system. If a computer process that is configured to prevent intrusions into the computer system is running on the computer system, the computer system may need to enforce restrictive policies for a web-browsing program (which needs to be sandboxed to minimize damage to the system) and more permissive policies for a program used to update applications on the system. Thus, such a system would want to be able to (i) persistently attach a particular policy with a particular program executable residing on the system and (ii) reliably locate and enforce this attached policy, when the program is launched and starts performing activity.
One prior art system applies policies based on the user-id under which the process is executing. This prior art system does not allow for differentiation of policies on a per-process level when all processes are executing under the same user-id. Furthermore, on a computer system running a Microsoft Corporation Windows operating system (hereinafter “Windows”), running application processes under separate user-ids would cause usability issues since the user-profile settings (such as Desktop and “my documents” folders, and the current-user registry-hive) would be completely different for each user-id.
Another prior art system identifies processes based on the executable-name (not the entire file-path). This limitation exists because the documented application program interfaces (APIs) in Windows for receiving process-creation information do not always supply the entire-path of the executable being launched. Undocumented means (such as operating-system-call hooking) are available, but suffer from reliability and portability issues.
In addition, another prior art system (in Windows) provides a hard-coded set of policies that can be enforced on a per-program basis. Unfortunately, this hard-coded set of policies cannot be meaningfully extended by third-party developers who wish to enforce their own policies during program execution. Prior Art
Therefore, a method and system of specifying and enforcing at least one run-time policy for at least one computer process executing on a computer system, where the computer system includes a computer operating system, is needed.
The present invention provides a method and system of specifying and enforcing at least one run-time policy for at least one computer process executing on a computer system, where the computer system includes a computer operating system. In an exemplary embodiment, the method and system include (1) relating the policy with an executable file of the process, (2) associating the policy with a running instance of the process, and (3) enforcing the policy on the running instance.
In an exemplary embodiment, the relating includes (a) storing the policy with the file in at least one alternate data stream and (b) allowing the policy to be retrieved from the alternate data stream by at least one attribute of the file. In an exemplary embodiment, the relating includes (a) storing the policy in a database entry in a database, wherein the database entry is associated with the file and (b) allowing the policy to be retrieved from the database by at least one attribute of the file. In an exemplary embodiment, the allowing includes allowing the policy to be retrieved from the alternate data stream by at least one attribute of the file, wherein the attribute is selected from the group consisting of the path of the file, the file identifier of the file, a digital signature of the file, and a checksum over the data in the file. In an exemplary embodiment, the allowing includes allowing comprises allowing the policy to be retrieved from the database by at least one attribute of the file, wherein the attribute is selected from the group consisting of the path of the file, the file identifier of the file, a digital signature of the file, and a checksum over the data in the file.
In an exemplary embodiment, the associating includes using a kernel-mode monitor to track at least one access by the process to the computer system. In an exemplary embodiment, the using includes using the monitor to track at least one access by the process to the file-system of the computer system. In an exemplary embodiment, the using includes using the monitor to track at least one access by the process to the system configuration of the computer system. In an exemplary embodiment, the using includes using the monitor to track at least one access by the process to a computer network that is logically connected to the computer system.
In an exemplary embodiment, the using includes, if the monitor detects a process-creation notification associated with the process, classifying the process as running under an unclassified policy. In an exemplary embodiment, the using includes, if the monitor detects at least one access by the process to the computer system, (a) intercepting the input/output of the process and (b) checking the classification of the process. In a further embodiment, the using further includes, if the process is running under an unclassified policy, (i) recording the process identifier of the process, (ii) blocking the process from proceeding further, and (iii) forwarding the process identifier to a privileged user-mode daemon. In a further embodiment, the using further includes verifying the process via the daemon.
In an exemplary embodiment, the verifying includes (a) locating the path of the file via the process identifier and at least one application program interface of the operating system, (b) retrieving the policy that is related to the process, and (c) returning the retrieved policy to the kernel-mode monitor. In an exemplary embodiment, the retrieving includes retrieving the policy by at least one attribute of the file. In an exemplary embodiment, the retrieving includes (i) retrieving the policy by at least one attribute of the file, where the attribute is selected from the group consisting of the path of the file, the file identifier of the file, a digital signature of the file, and a checksum over the data in the file and (ii) returning the found policy. In a further, the retrieving includes, if the finding fails, returning a default policy.
In an exemplary embodiment, the enforcing includes using the kernel-mode monitor to enforce the retrieved policy. In an exemplary embodiment, the using includes (a) classifying the process as running under a classified policy, (b) enforcing the retrieved policy on the access that had been detected by the monitor, and (c) enforcing the retrieved policy on at least one subsequent operation performed by the process.
The present invention also provides a computer program product usable with a programmable computer having readable program code embodied therein of specifying and enforcing at least one run-time policy for at least one computer process executing on a computer system. The computer program product includes (1) computer readable code for relating the policy with an executable file of the process, (2) computer readable code for associating the policy with a running instance of the process, and (3) computer readable code for enforcing the policy on the running instance.
The present invention provides a method and system of specifying and enforcing at least one run-time policy for at least one computer process executing on a computer system, where the computer system includes a computer operating system. In an exemplary embodiment, the method and system include (1) relating the policy with an executable file of the process, (2) associating the policy with a running instance of the process, and (3) enforcing the policy on the running instance.
Referring to
In an exemplary embodiment, the operating system includes the following features: (i) user-mode/kernel-mode privilege separation, (ii) virtual address space separation and protection between processes, (iii) the notion of users, and (iv) filtering frameworks to synchronously monitor processes when they access operating system resources. For example, the operating system could be a Microsoft® Corporation Windows® (hereinafter “Windows”) operating system, a UNIX® operating system, or an Apple Inc. MAC OS X operating system.
Referring to
If the monitor detects at least one access by the process to the computer system and if the process is running under an unclassified policy, monitor 223 records the process identifier (process-id) of process 221, blocks process 221 from proceeding further, and forwards the process identifier to a privileged user-mode daemon 222. Daemon 222 verifies process 221 by retrieving the policy for process 221 (i) either from database 230 or alternate data stream 240 or (ii) retrieving default policy 260, where daemon 222, database 230, alternate data stream 240, and default policy 260 logically form a policy framework 250. Once the policy has been retrieved, monitor 223 enforces the policy on the access that had been detected by monitor 223 and enforces the policy on subsequent operations of process 221.
Referring to
Referring to
Referring to
If the Monitor Detects a Process-Creation Notification
Referring to
If the Monitor Detects at Least One Access
Referring to
Referring to
Referring to
Referring to
Referring to
In an exemplary embodiment, the invention further includes after the process has been classified, using the daemon and the monitor to update the policy for the process dynamically.
The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment containing both hardware and software elements. In an exemplary embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, and microcode.
Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer system or any instruction execution system. The computer program product includes the instructions that implement the method of the present invention. A computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include compact disk-read only memory (CD-ROM), compact disk-read/write (CD-R/W), and DVD.
A computer system suitable for storing and/or executing program code includes at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements include local memory employed during actual execution of the program code, bulk storage, and cache memories that provide temporary storage of at least some program code to reduce the number of times code is retrieved from bulk storage during execution. Input/output (I/O) devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the computer system either directly or through intervening I/O controllers. Network adapters may also be coupled to the computer system in order to enable the computer system to become coupled to other computer systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the currently available types of network adapters.
Having fully described a preferred embodiment of the invention and various alternatives, those skilled in the art will recognize, given the teachings herein, that numerous alternatives and equivalents exist which do not depart from the invention. It is therefore intended that the invention not be limited by the foregoing description, but only by the appended claims.
