Computational system including mechanisms for tracking taint
AssigneeVMware, Inc.
InventorGeoffrey Pike
Life of this patent
Estimating the term…
Abstract
Mechanisms have been developed for securing computational systems against certain forms of attack. Taint status for data accessible by processes is selectively maintained and propagated in correspondence with information flows of instructions executed by a computing system, so that a security (or other appropriate) response can be provided if and when a control transfer (or other restricted use) is attempted based on tainted data. One response that may be triggered is a change in the privilege level (root and guest) that is used to process code executing in a virtual environment, so as to allow remediation to be performed. The triggering events may be specified in a control block.
Claims19
A method of changing a privilege level for implementing a process in a computational system, the computational system including a first privilege level and a second privilege level, the first privilege level having fewer privileges than the second privilege level, said method comprising:
- executing the process at the first privilege level;
- identifying a tainted portion of the process;
- determining a taint status of the tainted portion of the process;
- based on the taint status of the tainted portion of the process, switching the execution of the process from the first privilege level to the second privilege level;
- remediating the tainted portion of the process;
- and recommencing an execution of the process at the first privilege level when the tainted portion is remediated;
- and wherein the tainted portion of the process includes instructions to access data in one or more tainted locations, and wherein the method further comprises executing an additional process at the second privilege level, the additional process altering at least one of the one or more tainted locations to remediate the taint from the at least one tainted location.
A computational system that changes a privilege level for implementing a process, the computational system including a first privilege level and a second privilege level, the second privilege level having fewer privileges than the first privilege level, said system comprising:
- a memory for storing a control block that defines one or more conditions under which the process transitions from execution at the first privilege level to the second privilege level;
- and
- a processor programmed to:
- (i) execute the process at the first privilege level;
- identify a tainted portion of the process;
- compare the tainted portion of the process to the one or more conditions defined by the control block;
- based on the comparing, switch the execution of the process from the first privilege level to the second privilege level;
- remediate the tainted portion of the process;
- and
- recommence an execution of the process at the first privilege level when the tainted portion is remediated;
- and wherein the tainted portion of the process includes instructions to access data in one or more tainted locations, and wherein the method further comprises executing an additional process at the second privilege level, the additional process altering at least one of the one or more tainted locations to remediate the taint from the at least one tainted location.
A non-transitory computer readable storage medium containing embodying computer-executable instructions stored thereon that, when executed in a computing device, causes the computing device to carry out the steps of:
- executing a process at a first privilege level;
- identifying a tainted portion of the process;
- based on the tainted portion of the process, switching the execution of the process from the first privilege level to a second privilege level, the second privilege level having more privileges than the first privilege level;
- remediating the tainted portion of the process;
- and
- recommencing an execution of the process at the first privilege level when the tainted portion is remediated;
- and wherein the tainted portion of the process includes instructions to access data in one or more tainted locations, and wherein the method further comprises executing an additional process at the second privilege level, the additional process altering at least one of the one or more tainted locations to remediate the taint from the at least one tainted location.
Dependencies are inferred from the claim text.