US 2019/0294778 A1Published application

Method and system to securely run applications using containers

AssigneeInternational Business Machines Corporation

InventorsRossella De Gaetano, Alessandro Ghezzi, Corrado Gianfelici, Alfonso D'Aniello, Martha Pinelo, Valerio Mercuri

Life of this patent

Estimating the term…

Loading patent…

Abstract

An embodiment of the invention may include a method, computer program product and system for executing a software application. The embodiment may include receiving a notification of an intended execution of the software application directly within an operating system of the computing device. The embodiment may include halting the intended execution. The embodiment may include determining whether the software application is known and safe. The embodiment may include determining whether the software application is known and malicious. The embodiment may include creating a container on the computing device. The embodiment may include executing the software application within the container. The embodiment may include monitoring an execution behavior of the software application. The embodiment may include determining whether an anomaly has occurred within the execution behavior. In response to determining that an anomaly has not occurred, the embodiment may include executing the software application directly within the operating system.

Claims20

Dependent claims

A method for executing a software application, the method comprising:

receiving a notification of an intended execution, by a user of a computing device, of the software application directly within an operating system of the computing device, wherein execution of the software application comprises modification operations for modifying at least one resource of the computing device, and wherein the notification comprises a hash value identifying the software application;
halting the intended execution of the software application directly within the operating system of the computing device;
determining whether the software application is known and safe;
in response to determining that the software application is not known and safe, determining whether the software application is known and malicious;
in response to determining that the software application is not known and malicious, creating a container on the computing device;
executing the software application within the container;
monitoring an execution behavior of the software application executed within the container for a predetermined monitoring period;
monitoring activities of the user within the executed software application for the predetermined monitoring period;
determining whether an anomaly has occurred within the execution behavior of the software application during the predetermined monitoring period;
and
in response to determining that an anomaly has not occurred within the execution behavior of the software application during the predetermined monitoring period, executing the software application directly within the operating system of the computing device.

8 more elements

A computer program product for executing a software application, the computer program product comprising:

one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions comprising:
program instructions to receive a notification of an intended execution, by a user of a computing device, of the software application directly within an operating system of the computing device, wherein execution of the software application comprises modification operations for modifying at least one resource of the computing device, and wherein the notification comprises a hash value identifying the software application;
program instructions to halt the intended execution of the software application directly within the operating system of the computing device;
program instructions to determine whether the software application is known and safe;
in response to determining that the software application is not known and safe, program instructions to determine whether the software application is known and malicious;
in response to determining that the software application is not known and malicious, program instructions to create a container on the computing device;
program instructions to execute the software application within the container;
program instructions to monitor an execution behavior of the software application executed within the container for a predetermined monitoring period;
program instructions to monitor activities of the user within the executed software application for the predetermined monitoring period;
program instructions to determine whether an anomaly has occurred within the execution behavior of the software application during the predetermined monitoring period;
and
in response to determining that an anomaly has not occurred within the execution behavior of the software application during the predetermined monitoring period, program instructions to execute the software application directly within the operating system of the computing device.

9 more elements

A computer system for executing a software application, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the program instructions comprising:
program instructions to receive a notification of an intended execution, by a user of a computing device, of the software application directly within an operating system of the computing device, wherein execution of the software application comprises modification operations for modifying at least one resource of the computing device, and wherein the notification comprises a hash value identifying the software application;
program instructions to halt the intended execution of the software application directly within the operating system of the computing device;
program instructions to determine whether the software application is known and safe;
in response to determining that the software application is not known and safe, program instructions to determine whether the software application is known and malicious;
in response to determining that the software application is not known and malicious, program instructions to create a container on the computing device;
program instructions to execute the software application within the container;
program instructions to monitor an execution behavior of the software application executed within the container for a predetermined monitoring period;
program instructions to monitor activities of the user within the executed software application for the predetermined monitoring period;
program instructions to determine whether an anomaly has occurred within the execution behavior of the software application during the predetermined monitoring period;
and
in response to determining that an anomaly has not occurred within the execution behavior of the software application during the predetermined monitoring period, program instructions to execute the software application directly within the operating system of the computing device.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/928,259Filed 22 Mar 2018
Published: 26 Sep 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/567
Computer malware detection or handling, e.g. anti-virus arrangements: using dedicated hardware
G06F 2221/033
Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms: test or assess software

Family

US 10,664,592 B2Related patent
US 2019/0294778 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key