Demonstrating integrity of a compartment of a compartmented operating system
AssigneeHewlett-Packard Development Company, L.P.
InventorChristopher I. Dalton
Life of this patent
Estimating the term…
Abstract
A computing platform 20 runs a compartmented operating system 22 and includes a trusted device 23 for forming an integrity metric which a user can interrogate to confirm integrity of the operating system. Also, the integrity of an individual compartment 24 is verified by examining status information for that compartment including, for example, the identity of any open network connections, the identity of any running processes, and the status of a section of file space allocated to that compartment 24. Hence, the integrity of an individual compartment 24 of the compartmented operating system 22 can be demonstrated.
Claims18
A method for demonstrating integrity of an operating system compartment in a computing platform having a trusted device, comprising the steps of:
- (a) providing a host operating system of the computing platform;
- (b) determining a host operating system status of the host operating system using the trusted device;
- (c) providing a compartment of the host operating system;
- and
- (d) determining, by a processor, whether resources assigned to the compartment have been interfered with by resources from outside the compartment, the resources comprising at least a computer process assigned to the compartment;
- and
- (e) defining a compartment status based on the determining in step (d),
- wherein the step (d) comprises
- comparing a current state of the compartment against an expected state,
- providing information about the current state of the compartment, including information about at least one of (i) a section of file space allocated to the compartment, (ii) any processes allocated to the compartment, and (iii) any communication interfaces allocated to the compartment, and
- at least one of:
- confirming that the compartment has access only to an expected section of file space;
- confirming that the allocated section of file space is in an expected condition;
- confirming that only an expected process or processes are allocated to the compartment;
- and
- confirming that only an expected communication interface or communication interfaces are allocated to the compartment.
A computing platform, comprising:
- a host operating system;
- at least one compartment provided by the host operating system;
- a trusted device to determine a host operating system status of the host operating system;
- and
- a status unit to
- determine whether resources assigned to the compartment have been interfered with by resources from outside the compartment, the resources comprising at least a computer process assigned to the compartment, and
- define a compartment status based on the determination of whether the resources assigned to the compartment have been interfered with by resources from outside the compartment,
- wherein to determine whether the resources assigned to the compartment have been interfered with by resources from outside the compartment, the status unit is to:
- compare a current state of the compartment against an expected state,
- provide information about the current state of the compartment, including information about at least one of (i) a section of file space allocated to the compartment, (ii) any processes allocated to the compartment, and (iii) any communication interfaces allocated to the compartment, and
- at least one of:
- confirm that the compartment has access only to an expected section of file space,
- confirm that the allocated section of file space is in an expected condition,
- confirm that only an expected process or processes are allocated to the compartment, and
- confirm that only an expected communication interface or communication interfaces are allocated to the compartment.
Dependencies are inferred from the claim text.