Damage containment by translation
AssigneeSolidCore Systems, Inc.
InventorsBakul Shah, Rosen Sharma, Peter Haight
Life of this patent
Estimating the term…
Abstract
Interface elements of a logic module are translated by renaming, adding dummy elements, and/or associating traps with dummy elements. Trusted parties are made aware of renamed interface elements and thereby allowed to properly communicate with logic module. Untrusted parties are kept unaware of the interface translation, with attempts to guess correct interface elements likely to fail, instead resulting in communication attempts with dummy elements and subsequent trapping of the untrusted parties.
Claims29
A computer-assisted method for translating a logic module interface, comprising the steps of:
- determining a first interface of a logic module, the first interface having a first one or more interface element names;
- and
- generating a second interface of the logic module, the second interface having a second one or more interface element names;
- wherein the generating step comprises renaming the first one or more interface element names to produce the second one or more interface element names.
A computer-assisted method for translating a user module, comprising the steps of:
- determining a first user module and a translation, the translation mapping a first provider interface to a second provider interface;
- and
- generating a second user module according to the translation;
- wherein the generating step comprises replacing a first reference in the first user module to an element in the first provider interface with a second reference to an element in the second provider interface according to the translation.
A computer system, comprising:
- an operating system;
- a processing module, wherein the processing module is running the operating system;
- a first set of one or more system calls to the operating system for disclosing to trusted software modules;
- and
- a second set of one or more dummy systems calls to the operating system for trapping untrusted software modules.
A computer system comprising:
- a processing module;
- a software program;
- and an operating system;
- the software program configured for running on the operating system, the operating system having a translated system call interface, the translated system call interface comprising a first set of translated system call names for disclosing to trusted parties, the translated system call interface further comprising a second set of dummy system call names untranslated system call names for trapping entrusted parties, the software program comprising:
- a set of one or more instructions;
- wherein the set of one or more instructions comprises one or more references to the first set of translated system call names.
A shared software library stored on machine readable media, comprising:
- a first set of one or more library functions for disclosing to trusted software modules;
- and
- a second set of one or more dummy library functions for trapping untrusted software modules.
A hardware processing system, comprising:
- a processor;
- an instruction translation table;
- and
- a module name translation table;
- wherein the processor fetches an instruction, decodes the instruction according to a translation stored in the translation table, and executes the decoded instruction, and wherein instruction calls to modules are translated according to the module name translation table.
A method for generating a web page, comprising the steps of:
- receiving a web page request having a first URL;
- translating the first URL to a second URL according to a URL translation table, the second URL indicating a first web page, the first web page having a third one or more embedded URLS;
- and
- generating a second web page;
- wherein the generating step comprises replacing the third one or more embedded URLS with translated versions of said third one or more embedded URLS according to the URL translation table to obtain the second web page.
A method for processing a file access request, comprising the steps of:
- receiving a file access request having a first string;
- and
- translating the first string to a second string, the second string indicating a file name;
- wherein the translating step proceeds according to a file name translation table.
A method for providing access to a file system, comprising the steps of:
- receiving a file access request;
- and
- processing the request;
- wherein the file access request comprises a file name and a first file name extension, the processing step comprises translating the first file name extension to obtain a second file name extension and providing access to a file indicated by the file name and the second file name extension.
A method for processing a network packet, comprising the steps of:
- receiving a network packet, the network packet comprising a protocol type field having a first protocol type identifier;
- translating the first protocol type identifier to a second protocol type identifier;
- and
- routing the network packet according to a protocol indicated by the second protocol type identifier;
- wherein the translating step proceeds according to a protocol type field translation table.
A method for processing a database command, comprising the steps of:
- receiving a database command having a first command string;
- and
- translating the first command string to a second command string, the second command string indicating a database command keyword;
- wherein the translating step proceeds according to a database command keyword translation table.
Dependencies are inferred from the claim text.