US 9,003,543 B2Granted

Providing a security boundary

AssigneeMicrosoft Technology Licensing, LLC

InventorsKristofer Hellick Reierson, Lidiane Pereira de Souza, Angela Mele Anderson

Life of this patent

Estimating the term…

Loading patent…

Abstract

In order to enable potentially conflicting applications to execute on the same computer, application programming interface (API) calls are intercepted when an application attempts to access a computer system's resources. During a learning mode of operation, a security monitor stores data in a security monitor database identifying which applications are allowed to access the computer system resources. At runtime of an application, the security monitor operates in an enforcement mode and utilizes the contents of the security monitor database to determine if an application is permitted to access system resources. If data associated with the application is located in the security monitor database, the application is allowed to access computer system resources, if data associated with the application is not located in the security monitor database, the application is not allowed to access computer system resources.

Claims16

Dependent claims

A computer-implemented method for providing a security boundary, the computer-implemented method comprising performing computer-implemented operations for:

executing, by a computer, a security monitor in a learning mode of operation wherein the security monitor performs operations for
intercepting by way of the security monitor one or more application programming interface (API) calls placed by an application for accessing one or more system resources,
storing data in a security monitor database associated with accessing the system resources,
associating one or more access control lists (ACLs) with the system resources requested when intercepting the API calls to be used by the application, and
loading the security monitor database with the one or more ACLs;
and
executing the security monitor in an enforcement mode of operation wherein the security monitor performs operations for
determining by way of the security monitor at a runtime of the application whether the application placing the one or more API calls is authorized to access the system resources,
allowing the application access to the system resources when data associated with the application is located in the security monitor database, and
preventing the application access to the system resources when data associated with the application is not located in the security monitor database.

7 more elements

An optical disk, a magnetic storage device, or a solid state storage device having computer-readable instructions stored thereupon which, when executed by a computer, cause the computer to:

execute a security monitor in a learning mode of operation, wherein when in the learning mode of operation, the security monitor
intercepts by way of a security monitor one or more application program interface (API) calls placed by an application for accessing one or more system resources,
stores data related to the API calls in a security monitor database,
associates one or more access control lists (ACLs) with the system resources requested when intercepting the API calls to be used by the application, and
loads the security monitor database with the one or more ACLs;
execute the security monitor in an enforcement mode of operation, wherein when in the enforcement mode of operation, the security monitor
isolates one or more other applications from accessing the system resources based on the data stored in the security monitor database,
allows the application access to the system resources when data associated with the application is found in the security monitor database, and
prevents the application from accessing the system resources when data associated with the application is not found in the security monitor database.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/973,907Filed 21 Dec 2010
Published: US 2012/0159570 A121 Jun 2012
Granted: 7 Apr 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/74
To assure secure computing or processing of information: operating in dual or compartmented mode, i.e. at least one secure mode
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 2221/2141
Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for…:…