Method for protecting computer programs and data from hostile code
AssigneeTrustware International Limited
InventorEyal Dotan
Life of this patent
Estimating the term…
Abstract
A method that protects computer data from untrusted programs. Each computer's object and process is assigned with trust attributes, which define the way it can interact with other objects within the system. When an object is classified as untrusted, it can interact with other object within the system on a limited basis. A virtualized system is provided on the computer so that when the untrusted object attempts to perform an operation that is outside its scope of authorization, the virtualized system intercepts the operation but present the untrusted program with an indication that the requested operation has been performed. The method further includes processes to securely move a program from an untrusted group to a trusted group.
Claims18
A computerized method of managing a computer's operation, comprising:
- whenever a program is started in the computer, performing a check to determine whether the program should be allowed to run on the computer on an unlimited trusted mode and, if yes, allowing the program to run on the computer on an unlimited mode;
- otherwise, when it is determined that the program should not be run on an unlimited trusted mode, limiting the program to run in a virtualized environment;
- wherein said virtualized environment causes the computer to:
- intercept a disallowed operation request sent from the program to the computer's operating system;
- modify the disallowed operation request to obtain a modified operation request;
- provide the modified operation request to the operating system;
- send to the program an indication that the disallowed operation request has been performed as requested by the program.
A computerized method of managing a computer's operation, comprising:
- whenever a program is started in the computer, performing a check to determine whether the program is listed on a black list and, if not, allowing the program to run on the computer on an unlimited trusted mode;
- otherwise, when it is determined that the program is listed on the black list, limiting the program to run in a virtualized environment;
- wherein said virtualized environment causes the computer to:
- intercept a disallowed operation request sent from the program to the computer's operating system;
- modify the operation request to obtain a modified operation request;
- perform one of:
- execute the modified operation request or provide the modified operation request to the operating system;
- send to the program an indication that the disallowed operation request has been performed as requested by the program.
A computerized method of managing a computer's operation, comprising:
- whenever a program is started in the computer, intercepting the program to determine whether the program is trusted or untrusted and, if trusted, allowing the program to run on the computer on an unlimited trusted mode;
- otherwise, if untrusted, limiting the program to run in a virtualized environment;
- wherein said virtualized environment causes the computer to:
- intercept a disallowed operation request sent from the program to the computer's operating system;
- perform one of:
- execute the operation request without providing it to the operating system;
- or,
- modify the operation request and provide the modified operation request to the operating system;
- send to the program an indication that the disallowed operation request has been performed as requested by the program.
Dependencies are inferred from the claim text.